Vendor: Cisco

Product: ACI

Use-Case: Malware

Rules	Models	MITRE ATT&CK® TTPs	Event Types	Parsers
1	0	1	1	1

Event Type	Rules	Models
authentication-successful	T1078 - Valid Accounts ↳ Auth-Blacklist-Shost: User authentication or login from a known blacklisted IP