Vendor: Sailpoint

June 14, 2023 · View on GitHub

Product: FAM

Use-Case: Privileged Activity

RulesModelsMITRE ATT&CK® TTPsEvent TypesParsers
10144
Event TypeRulesModels
file-deleteT1078 - Valid Accounts
FA-Account-deactivated: File Activity from a de-activated user account
file-permission-changeT1078 - Valid Accounts
FA-Account-deactivated: File Activity from a de-activated user account
file-readT1078 - Valid Accounts
FA-Account-deactivated: File Activity from a de-activated user account
file-writeT1078 - Valid Accounts
FA-Account-deactivated: File Activity from a de-activated user account