Use Case: Workforce Protection

Vendor: Abnormal Security

Product	Event Types	MITRE ATT&CK® TTP	Content
Abnormal Security	dlp-email-alert-out security-alert	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models

Vendor: Accellion

Product	Event Types	MITRE ATT&CK® TTP	Content
Kiteworks	account-lockout account-password-change account-password-reset account-unlocked app-activity app-login dlp-alert dlp-email-alert-out failed-app-login file-delete file-download file-permission-change file-read file-upload file-write	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models

Vendor: Akamai

Product	Event Types	MITRE ATT&CK® TTP	Content
Cloud Akamai	web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: Amazon

Product	Event Types	MITRE ATT&CK® TTP	Content
AWS WAF	web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: Apache

Product	Event Types	MITRE ATT&CK® TTP	Content
Apache	web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: Barracuda

Product	Event Types	MITRE ATT&CK® TTP	Content
Barracuda Email Security Gateway	dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models

Vendor: Bitglass

Product	Event Types	MITRE ATT&CK® TTP	Content
Bitglass CASB	app-login dlp-alert dlp-email-alert-out failed-app-login file-download file-read file-write	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models

Vendor: CatoNetworks

Product	Event Types	MITRE ATT&CK® TTP	Content
Cato Cloud	network-alert vpn-connection vpn-login vpn-logout web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: Check Point

Product	Event Types	MITRE ATT&CK® TTP	Content
Avanan	dlp-alert dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed security-alert	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models
NGFW	app-login authentication-failed authentication-successful dlp-email-alert-in dlp-email-alert-out failed-vpn-login local-logon network-alert network-connection-failed network-connection-successful vpn-connection vpn-login vpn-logout web-activity-allowed web-activity-denied	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1071.001 - Application Layer Protocol: Web Protocols	8 Rules 3 Models

Vendor: Cisco

Product	Event Types	MITRE ATT&CK® TTP	Content
ADC	web-activity-allowed	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models
Cisco Secure Email	dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models
Cloud Web Security	web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models
Firepower	authentication-successful dns-query dns-response failed-vpn-login file-download nac-logon netflow-connection network-alert network-connection-failed network-connection-successful process-created security-alert vpn-login vpn-logout web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models
IronPort Email	dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models
IronPort Web Security	web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models
Meraki MX appliances	network-alert network-connection-failed network-connection-successful vpn-login vpn-logout web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models
Proxy Umbrella	network-connection-successful web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models
Secure Email	dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models
Secure Web Appliance	web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models
Umbrella	dns-response web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: Citrix

Product	Event Types	MITRE ATT&CK® TTP	Content
Citrix Netscaler VPN	authentication-failed authentication-successful remote-access remote-logon vpn-connection vpn-logout web-activity-allowed	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models
Web Logging	web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: Clearswift SEG

Product	Event Types	MITRE ATT&CK® TTP	Content
Clearswift SEG	dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models

Vendor: Cloudflare

Product	Event Types	MITRE ATT&CK® TTP	Content
Cloudflare WAF	network-alert network-connection-failed network-connection-successful web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: Code42

Product	Event Types	MITRE ATT&CK® TTP	Content
Code42 Incydr	"app-activity" "file-delete" "file-download" "file-read" "file-upload" "file-write" "print-activity" "usb-activity" app-activity dlp-email-alert-out file-delete file-download file-read file-upload file-write print-activity security-alert usb-activity usb-insert	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models

Vendor: Digital Arts

Product	Event Types	MITRE ATT&CK® TTP	Content
Digital Arts i-FILTER for Business	web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: Digital Guardian

Product	Event Types	MITRE ATT&CK® TTP	Content
Digital Guardian Endpoint Protection	app-activity app-login dlp-email-alert-out file-delete file-download file-read file-upload file-write local-logon network-connection-failed network-connection-successful print-activity process-created usb-insert usb-write	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models
Digital Guardian Network DLP	dlp-alert dlp-email-alert-out dlp-email-alert-out-failed	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models

Vendor: Dtex Systems

Product	Event Types	MITRE ATT&CK® TTP	Content
DTEX InTERCEPT	file-delete file-read file-write local-logon print-activity process-created remote-logon usb-write web-activity-allowed workstation-locked workstation-unlocked	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: EdgeWave

Product	Event Types	MITRE ATT&CK® TTP	Content
EdgeWave iPrism	web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: F5

Product	Event Types	MITRE ATT&CK® TTP	Content
F5 Advanced Web Application Firewall (WAF)	account-switch dlp-email-alert-out network-alert network-connection-failed network-connection-successful process-created remote-logon	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models
F5 BIG-IP Application Security Manager (ASM)	security-alert web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models
WebSafe	web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: Fidelis

Product	Event Types	MITRE ATT&CK® TTP	Content
Fidelis XPS	dlp-email-alert-in dlp-email-alert-out security-alert	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models

Vendor: FireEye

Product	Event Types	MITRE ATT&CK® TTP	Content
FireEye Network Security (NX)	security-alert web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: Forcepoint

Product	Event Types	MITRE ATT&CK® TTP	Content
Forcepoint DLP	dlp-alert dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed usb-insert	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models
Forcepoint Email Security	dlp-email-alert-in dlp-email-alert-out	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models
Websense Secure Gateway	web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: Fortinet

Product	Event Types	MITRE ATT&CK® TTP	Content
FortiGate	network-connection-successful vpn-connection web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models
Fortinet FortiWeb	web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models
Fortinet UTM	app-activity app-activity-failed authentication-failed authentication-successful dlp-alert dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed network-alert security-alert web-activity-allowed web-activity-denied	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1071.001 - Application Layer Protocol: Web Protocols	8 Rules 3 Models

Vendor: Google

Product	Event Types	MITRE ATT&CK® TTP	Content
Cloud Platform	app-activity cloud-admin-activity cloud-admin-activity-failed gcp-disk-attach gcp-disk-create gcp-image-create gcp-instance-create gcp-instance-setmachinetype gcp-instance-setmetadata gcp-policy-write gcp-role-write gcp-serviceaccount-creds-write gcp-serviceaccount-write gcp-snapshot-create gcp-storageobject-acl netflow-connection network-alert storage-access storage-activity storage-activity-failed web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models
Workspace	account-password-change account-password-reset app-activity app-login dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed failed-app-login file-delete file-download file-permission-change file-read file-upload file-write	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models

Vendor: HashiCorp

Product	Event Types	MITRE ATT&CK® TTP	Content
Terraform	web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: Hornet

Product	Event Types	MITRE ATT&CK® TTP	Content
Hornet Email	dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed security-alert	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models

Vendor: IBM

Product	Event Types	MITRE ATT&CK® TTP	Content
IBM Security Access Manager	web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: IMSVA

Product	Event Types	MITRE ATT&CK® TTP	Content
IMSVA	dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models

Vendor: Imperva

Product	Event Types	MITRE ATT&CK® TTP	Content
Incapsula	web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: InfoWatch

Product	Event Types	MITRE ATT&CK® TTP	Content
InfoWatch	app-login dlp-email-alert-in dlp-email-alert-out print-activity usb-write web-activity-allowed	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1071.001 - Application Layer Protocol: Web Protocols	8 Rules 3 Models

Vendor: Juniper Networks

Product	Event Types	MITRE ATT&CK® TTP	Content
Juniper SRX	authentication-successful failed-vpn-login network-alert network-connection-failed network-connection-successful security-alert vpn-login web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models
Juniper VPN	account-deleted authentication-failed authentication-successful failed-vpn-login vpn-login vpn-logout web-activity-allowed	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: LanScope

Product	Event Types	MITRE ATT&CK® TTP	Content
LanScope Cat	app-activity dlp-alert failed-usb-activity file-delete file-write local-logon print-activity process-created process-created-failed process-network usb-activity usb-write web-activity-allowed workstation-locked workstation-unlocked	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: McAfee

Product	Event Types	MITRE ATT&CK® TTP	Content
McAfee DLP	dlp-alert dlp-email-alert-out dlp-email-alert-out-failed failed-usb-activity print-activity usb-insert usb-write	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models
McAfee Email Protection	dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models
McAfee Web Gateway	web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: Microsoft

Product	Event Types	MITRE ATT&CK® TTP	Content
365 Defender	dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed security-alert	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models
Exchange	app-activity app-activity-failed app-login dlp-alert dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed failed-app-login	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models
IIS	web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models
Office 365	account-password-change app-activity app-activity-failed app-login dlp-alert dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed failed-app-login file-delete file-download file-permission-change file-read file-upload file-write process-created security-alert usb-write	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models
Web Application Proxy	remote-logon web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models
Web Application Proxy-TLS Gateway	web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: Mimecast

Product	Event Types	MITRE ATT&CK® TTP	Content
Email Security	app-activity app-login dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed failed-app-login	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models
Targeted Threat Protection - URL	web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: Netskope

Product	Event Types	MITRE ATT&CK® TTP	Content
Security Cloud	app-activity app-login dlp-alert dlp-email-alert-out failed-app-login file-delete file-download file-permission-change file-read file-upload file-write network-connection-failed network-connection-successful security-alert web-activity-allowed web-activity-denied	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1071.001 - Application Layer Protocol: Web Protocols	8 Rules 3 Models

Vendor: NextDLP

Product	Event Types	MITRE ATT&CK® TTP	Content
Reveal	authentication-failed dlp-alert member-added remote-logon security-alert usb-insert web-activity-allowed	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: Palo Alto Networks

Product	Event Types	MITRE ATT&CK® TTP	Content
NGFW	authentication-failed authentication-successful config-change dlp-alert file-alert network-alert network-connection-failed network-connection-successful remote-logon security-alert vpn-login web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models
Prisma Access	dns-query web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: Postfix

Product	Event Types	MITRE ATT&CK® TTP	Content
Postfix	dlp-email-alert-in dlp-email-alert-out	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models

Vendor: Proofpoint

Product	Event Types	MITRE ATT&CK® TTP	Content
Proofpoint DLP	dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models
Proofpoint Enterprise Protection	dlp-alert dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed security-alert	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models
Proofpoint TAP	dlp-alert dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models
Proofpoint TAP/POD	dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models

Vendor: QUSH

Product	Event Types	MITRE ATT&CK® TTP	Content
Reveal	dlp-alert file-upload file-write nac-logon print-activity remote-logon usb-insert web-activity-allowed	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: RSA

Product	Event Types	MITRE ATT&CK® TTP	Content
RSA DLP	dlp-alert dlp-email-alert-out	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models

Vendor: SIGSCI

Product	Event Types	MITRE ATT&CK® TTP	Content
SIGSCI	web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: SafeSend

Product	Event Types	MITRE ATT&CK® TTP	Content
SafeSend	dlp-email-alert-out	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models

Vendor: Salesforce

Product	Event Types	MITRE ATT&CK® TTP	Content
Salesforce	account-switch app-activity app-login dlp-email-alert-out failed-app-login file-download file-upload	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models

Vendor: Sangfor

Product	Event Types	MITRE ATT&CK® TTP	Content
NGAF	network-alert web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: SentinelOne

Product	Event Types	MITRE ATT&CK® TTP	Content
Singularity Platform	"app-activity" "process-created" "process-network" "security-alert" app-activity dns-query dns-response file-alert file-delete file-read file-write network-alert network-connection-failed network-connection-successful process-alert process-created registry-write security-alert task-created web-activity-allowed	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: SkySea

Product	Event Types	MITRE ATT&CK® TTP	Content
ClientView	app-activity app-login dlp-email-alert-out file-delete file-download file-read file-upload file-write print-activity process-created security-alert share-access usb-activity web-activity-allowed web-activity-denied	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1071.001 - Application Layer Protocol: Web Protocols	8 Rules 3 Models

Vendor: Sonicwall

Product	Event Types	MITRE ATT&CK® TTP	Content
Sonicwall	failed-vpn-login network-alert remote-logon vpn-login vpn-logout web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: Sophos

Product	Event Types	MITRE ATT&CK® TTP	Content
Sophos UTM	web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models
Sophos XG Firewall	app-login failed-vpn-login network-connection-failed network-connection-successful vpn-login vpn-logout web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: Squid

Product	Event Types	MITRE ATT&CK® TTP	Content
Squid	web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: Symantec

Product	Event Types	MITRE ATT&CK® TTP	Content
Symantec Blue Coat ProxySG Appliance	network-connection-failed web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models
Symantec Brightmail	dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models
Symantec DLP	dlp-alert dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed print-activity security-alert usb-activity usb-insert usb-read usb-write	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models
Symantec Email Security.cloud	dlp-email-alert-in dlp-email-alert-out dlp-email-alert-out-failed security-alert	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models
Symantec Fireglass	web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models
Symantec Secure Web Gateway	web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models
Symantec WSS	web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: Tessian

Product	Event Types	MITRE ATT&CK® TTP	Content
Tessian Cloud Email Security	dlp-email-alert-in dlp-email-alert-out	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models

Vendor: Trend Micro

Product	Event Types	MITRE ATT&CK® TTP	Content
Apex One	dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed security-alert	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models
InterScan Web Security	web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models
OfficeScan	dlp-alert dlp-email-alert-in dlp-email-alert-out privileged-object-access security-alert usb-write web-activity-allowed	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1071.001 - Application Layer Protocol: Web Protocols	8 Rules 3 Models

Vendor: Unix

Product	Event Types	MITRE ATT&CK® TTP	Content
Unix	account-creation account-deleted account-lockout account-password-change account-switch authentication-failed authentication-successful batch-logon computer-logon dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed failed-logon file-delete file-permission-change file-read file-write kerberos-logon local-logon member-added member-removed network-connection-failed process-created process-created-failed remote-access remote-logon security-alert task-created	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models
Unix Sendmail	dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	4 Rules 1 Models

Vendor: Vectra

Product	Event Types	MITRE ATT&CK® TTP	Content
Cognito Stream	authentication-failed authentication-successful dlp-email-alert-out file-delete file-read file-write ntlm-logon remote-logon web-activity-allowed web-activity-denied	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1071.001 - Application Layer Protocol: Web Protocols	8 Rules 3 Models

Vendor: Watchguard

Product	Event Types	MITRE ATT&CK® TTP	Content
Watchguard	network-connection-failed network-connection-successful web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: Weblogin

Product	Event Types	MITRE ATT&CK® TTP	Content
Weblogin	web-activity-allowed	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: Zeek

Product	Event Types	MITRE ATT&CK® TTP	Content
Zeek Network Security Monitor	app-activity authentication-failed authentication-successful computer-logon dlp-email-alert-in dlp-email-alert-out dns-query dns-response failed-logon file-delete file-read file-write kerberos-logon nac-failed-logon nac-logon network-alert network-connection-failed network-connection-successful ntlm-logon remote-access remote-logon share-access web-activity-allowed web-activity-denied	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1071.001 - Application Layer Protocol: Web Protocols	8 Rules 3 Models

Vendor: Zoom

Product	Event Types	MITRE ATT&CK® TTP	Content
Zoom	web-meeting-created web-meeting-ended web-meeting-participant-joined web-meeting-started web-meeting-updated webconference-login webconference-operations-activity	T1078.004 - Valid Accounts: Cloud Accounts T1090.003 - Proxy: Multi-hop Proxy T1098 - Account Manipulation	11 Rules 5 Models

Vendor: Zscaler

Product	Event Types	MITRE ATT&CK® TTP	Content
Zscaler Internet Access	app-login dlp-alert network-connection-failed network-connection-successful web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models

Vendor: iBoss

Product	Event Types	MITRE ATT&CK® TTP	Content
Secure Web Gateway	web-activity-allowed web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models