Enterprise Security: how come tag = attack map to two different datamodels?

[danielbb]

We see the following -

And

So, for the events which are mapped to tag = attack, can they belong to different datamodels?

[starcher]

That is correct. One is malware + attack. The other ids + attack. Event types should be mapped to the pairing that is appropriate