2_ds_proofpoint_proofpoint_tap.md

June 14, 2023 · View on GitHub

Use-CaseEvent Types/ParsersMITRE ATT&CK® TTPContent
Malwaredlp-alert
↳json-s-proofpoint-email-alert-2
↳s-proofpoint-email-alert-2

dlp-email-alert-in
↳cef-proofpoint-email-in
↳s-proofpoint-email-in
↳proofpoint-email-1
↳proofpoint-email-2
↳proofpoint-email-3

dlp-email-alert-out
↳proofpoint-email-1
↳proofpoint-email-2
↳proofpoint-email-3
T1190 - Exploit Public Fasing Application
TA0002 - TA0002
  • 5 Rules
  • 2 Models
Privilege Abusedlp-email-alert-in
↳cef-proofpoint-email-in
↳s-proofpoint-email-in
↳proofpoint-email-1
↳proofpoint-email-2
↳proofpoint-email-3

dlp-email-alert-in-failed
↳cef-proofpoint-email-in
↳s-proofpoint-email-alert-3
↳s-proofpoint-email-in
↳proofpoint-email-1
↳proofpoint-email-2
↳proofpoint-email-3
↳json-s-proofpoint-email-alert-2
↳s-proofpoint-email-alert-2

dlp-email-alert-out
↳proofpoint-email-1
↳proofpoint-email-2
↳proofpoint-email-3

dlp-email-alert-out-failed
↳proofpoint-email-1
↳proofpoint-email-2
↳proofpoint-email-3
T1078 - Valid Accounts
  • 1 Rules
Privileged Activitydlp-email-alert-in
↳cef-proofpoint-email-in
↳s-proofpoint-email-in
↳proofpoint-email-1
↳proofpoint-email-2
↳proofpoint-email-3

dlp-email-alert-in-failed
↳cef-proofpoint-email-in
↳s-proofpoint-email-alert-3
↳s-proofpoint-email-in
↳proofpoint-email-1
↳proofpoint-email-2
↳proofpoint-email-3
↳json-s-proofpoint-email-alert-2
↳s-proofpoint-email-alert-2

dlp-email-alert-out
↳proofpoint-email-1
↳proofpoint-email-2
↳proofpoint-email-3

dlp-email-alert-out-failed
↳proofpoint-email-1
↳proofpoint-email-2
↳proofpoint-email-3
T1078 - Valid Accounts
  • 1 Rules