Use Case: Data Access
July 25, 2023 ยท View on GitHub
Use Case: Data Access
Vendor: Accellion
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Accellion |
| T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
Vendor: Adaxes
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Adaxes |
| T1078 - Valid Accounts |
|
Vendor: Airlock
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Airlock |
| T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
Vendor: Amazon
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| AWS CloudTrail |
| T1078 - Valid Accounts |
|
| AWS CloudWatch |
| T1078 - Valid Accounts |
|
Vendor: Apache Subversion
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Apache Subversion |
| T1078 - Valid Accounts |
|
Vendor: AssetView
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| AssetView |
| T1083 - File and Directory Discovery |
|
Vendor: Atlassian
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Atlassian BitBucket |
| T1078 - Valid Accounts |
|
Vendor: Barracuda
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Barracuda Firewall |
| T1078 - Valid Accounts T1110 - Brute Force |
|
Vendor: BeyondTrust
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| BeyondTrust |
| T1078 - Valid Accounts |
|
| BeyondTrust PowerBroker |
| T1003 - OS Credential Dumping |
|
| BeyondTrust Privilege Management |
| T1003 - OS Credential Dumping |
|
| BeyondTrust Privileged Identity |
| T1078 - Valid Accounts |
|
Vendor: Bitdefender
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Bitdefender |
| T1078 - Valid Accounts |
|
Vendor: Bitglass
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Bitglass CASB |
| T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
Vendor: BlackBerry
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| BlackBerry Protect |
| T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
Vendor: Box
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Box Cloud Content Management |
| T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
Vendor: Bromium
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Bromium Secure Platform |
| T1083 - File and Directory Discovery |
|
Vendor: CatoNetworks
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Cato Cloud |
| T1078 - Valid Accounts T1110 - Brute Force |
|
Vendor: Centrify
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Centrify Audit and Monitoring Service |
| T1083 - File and Directory Discovery |
|
| Centrify Infrastructure Services |
| T1003 - OS Credential Dumping |
|
| Centrify Zero Trust Privilege Services |
| T1078 - Valid Accounts |
|
Vendor: Check Point Software
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Check Point Identity Awareness |
| T1078 - Valid Accounts T1110 - Brute Force |
|
| Check Point NGFW |
| T1078 - Valid Accounts T1110 - Brute Force |
|
| Check Point Security Gateway |
| T1078 - Valid Accounts T1110 - Brute Force |
|
| Check Point Threat Prevention |
| T1078 - Valid Accounts T1110 - Brute Force |
|
Vendor: Cisco
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| AnyConnect |
| T1078 - Valid Accounts T1110 - Brute Force |
|
| Cisco ACS |
| T1078 - Valid Accounts |
|
| Cisco Adaptive Security Appliance |
| T1003 - OS Credential Dumping T1078 - Valid Accounts T1110 - Brute Force |
|
| Cisco Call Manager |
| T1078 - Valid Accounts |
|
| Cisco Firepower |
| T1078 - Valid Accounts T1110 - Brute Force |
|
| Cisco ISE |
| T1078 - Valid Accounts T1110 - Brute Force |
|
| Cisco Meraki MX appliances |
| T1078 - Valid Accounts T1110 - Brute Force |
|
| Cisco NPE |
| T1003 - OS Credential Dumping |
|
| Cisco TACACS |
| T1003 - OS Credential Dumping |
|
| Duo Access Security |
| T1078 - Valid Accounts |
|
Vendor: Citrix
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Citrix Endpoint Management |
| T1078 - Valid Accounts |
|
| Citrix Gateway ActiveSync Connector |
| T1078 - Valid Accounts |
|
| Citrix Netscaler |
| T1003 - OS Credential Dumping T1078 - Valid Accounts T1110 - Brute Force |
|
| Citrix Netscaler VPN |
| T1078 - Valid Accounts T1110 - Brute Force |
|
| Citrix ShareFile |
| T1078 - Valid Accounts |
|
| Citrix XenApp |
| T1078 - Valid Accounts |
|
Vendor: Cloud Application
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Cloud Application |
| T1078 - Valid Accounts |
|
Vendor: Cloudflare
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Cloudflare Insights |
| T1078 - Valid Accounts |
|
Vendor: Code42
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Code42 Incydr |
| T1083 - File and Directory Discovery |
|
Vendor: CrowdStrike
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Falcon |
| T1003 - OS Credential Dumping T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
Vendor: CyberArk
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| CyberArk Vault |
| T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
| Privileged Session Manager |
| T1078 - Valid Accounts |
|
Vendor: DTEX InTERCEPT
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| DTEX InTERCEPT |
| T1083 - File and Directory Discovery |
|
Vendor: Darktrace
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Darktrace |
| T1078 - Valid Accounts |
|
Vendor: Dell
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Dell EMC Isilon |
| T1083 - File and Directory Discovery |
|
| One Identity Manager |
| T1078 - Valid Accounts |
|
| SonicWALL Aventail |
| T1078 - Valid Accounts T1110 - Brute Force |
|
Vendor: Digital Guardian
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Digital Guardian Endpoint Protection |
| T1003 - OS Credential Dumping T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
Vendor: Dropbox
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Dropbox |
| T1078 - Valid Accounts T1083 - File and Directory Discovery T1110 - Brute Force |
|
Vendor: Dtex Systems
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| DTEX InTERCEPT |
| T1003 - OS Credential Dumping T1083 - File and Directory Discovery |
|
Vendor: Duo Access Security
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Duo Access Security |
| T1078 - Valid Accounts |
|
Vendor: EMP
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| EMP |
| T1078 - Valid Accounts |
|
Vendor: ESET
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| ESET Endpoint Security |
| T1078 - Valid Accounts |
|
Vendor: ESector
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| ESector DEFESA |
| T1083 - File and Directory Discovery |
|
Vendor: Egnyte
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Egnyte |
| T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
Vendor: Epic
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Epic SIEM |
| T1078 - Valid Accounts |
|
Vendor: F5
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| F5 BIG-IP Access Policy Manager (APM) |
| T1078 - Valid Accounts T1110 - Brute Force |
|
Vendor: FTP
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| FTP |
| T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
Vendor: Fast Enterprises
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Fast Enterprises GenTax |
| T1078 - Valid Accounts |
|
Vendor: FireEye
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| FireEye Endpoint Security (HX) |
| T1083 - File and Directory Discovery |
|
Vendor: Forcepoint
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Forcepoint CASB |
| T1078 - Valid Accounts |
|
Vendor: Fortinet
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Fortinet Enterprise Firewall |
| T1078 - Valid Accounts |
|
| Fortinet UTM |
| T1078 - Valid Accounts T1110 - Brute Force |
|
| Fortinet VPN |
| T1078 - Valid Accounts T1110 - Brute Force |
|
Vendor: GitHub
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| GitHub |
| T1078 - Valid Accounts |
|
Vendor: Google
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| T1078 - Valid Accounts |
| |
| Google Calendar |
| T1078 - Valid Accounts |
|
| Google Cloud Platform |
| T1078 - Valid Accounts |
|
| Google Drive |
| T1083 - File and Directory Discovery |
|
Vendor: HP
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| HP Comware |
| T1003 - OS Credential Dumping |
|
| HP Virtual Connect Enterprise Manager |
| T1078 - Valid Accounts |
|
Vendor: HashiCorp
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| HashiCorp Vault |
| T1078 - Valid Accounts |
|
Vendor: HelpSystems
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Powertech Identity Access Manager (BoKs) |
| T1003 - OS Credential Dumping T1083 - File and Directory Discovery |
|
Vendor: Huawei
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Unified Security Gateway |
| T1003 - OS Credential Dumping |
|
Vendor: IBM
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| IBM DB2 |
| T1083 - File and Directory Discovery |
|
| IBM Racf |
| T1078 - Valid Accounts |
|
| IBM Sametime |
| T1078 - Valid Accounts |
|
| IBM Sterling B2B Integrator |
| T1078 - Valid Accounts |
|
| Infosphere Guardium |
| T1213 - Data from Information Repositories |
|
Vendor: ICDB
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| ICDB |
| T1078 - Valid Accounts |
|
Vendor: Imperva
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| CounterBreach |
| T1213 - Data from Information Repositories |
|
| Imperva File Activity Monitoring (FAM) |
| T1083 - File and Directory Discovery |
|
| Imperva SecureSphere |
| T1078 - Valid Accounts T1213 - Data from Information Repositories |
|
Vendor: InfoWatch
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| InfoWatch |
| T1078 - Valid Accounts |
|
Vendor: Infoblox
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Infoblox BloxOne |
| T1078 - Valid Accounts |
|
Vendor: Ipswitch
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| IPswitch MoveIt |
| T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
| MoveIt DMZ |
| T1083 - File and Directory Discovery |
|
Vendor: Johnson Controls
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Johnson Controls P2000 |
| T1078 - Valid Accounts |
|
Vendor: Juniper Networks
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Juniper Networks Pulse Secure |
| T1078 - Valid Accounts |
|
| Juniper OWA |
| T1078 - Valid Accounts |
|
| Juniper SRX |
| T1078 - Valid Accounts T1110 - Brute Force |
|
| Juniper VPN |
| T1078 - Valid Accounts T1110 - Brute Force |
|
Vendor: Kemp
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Kemp LoadMaster |
| T1078 - Valid Accounts |
|
Vendor: Kiteworks
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Kiteworks |
| T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
Vendor: LEAP
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| LEAP |
| T1078 - Valid Accounts |
|
Vendor: LOGBinder
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| SharePoint |
| T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
Vendor: LanScope Cat
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| LanScope Cat |
| T1003 - OS Credential Dumping T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
Vendor: LanScope
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| LanScope Cat |
| T1078 - Valid Accounts |
|
Vendor: LastPass
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| LastPass |
| T1078 - Valid Accounts |
|
Vendor: LogRhythm
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| LogRhythm |
| T1003 - OS Credential Dumping |
|
Vendor: Lumension
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Lumension |
| T1078 - Valid Accounts |
|
Vendor: McAfee
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| MDAM |
| T1213 - Data from Information Repositories |
|
| McAfee Endpoint Security |
| T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
| Skyhigh Networks CASB |
| T1078 - Valid Accounts |
|
Vendor: Microsoft
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Exchange |
| T1078 - Valid Accounts |
|
| Microsoft Azure |
| T1003 - OS Credential Dumping T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
| Microsoft Azure Active Directory |
| T1078 - Valid Accounts |
|
| Microsoft Azure MFA |
| T1078 - Valid Accounts |
|
| Microsoft Cloud App Security (MCAS) |
| T1003 - OS Credential Dumping T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
| Microsoft Defender ATP |
| T1003 - OS Credential Dumping |
|
| Microsoft Office 365 |
| T1003 - OS Credential Dumping T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
| Microsoft OneDrive |
| T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
| Microsoft SQL Server |
| T1078 - Valid Accounts |
|
| Microsoft Sysmon |
| T1003 - OS Credential Dumping T1083 - File and Directory Discovery |
|
| Microsoft Windows |
| T1003 - OS Credential Dumping T1078 - Valid Accounts T1083 - File and Directory Discovery T1110 - Brute Force |
|
| NetApp |
| T1083 - File and Directory Discovery |
|
| Windows Defender |
| T1078 - Valid Accounts |
|
Vendor: Mimecast
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Mimecast |
| T1078 - Valid Accounts |
|
| Mimecast Email Security |
| T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
Vendor: NCP
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| NCP |
| T1078 - Valid Accounts T1110 - Brute Force |
|
Vendor: NNT
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| NNT ChangeTracker |
| T1078 - Valid Accounts |
|
Vendor: NetApp
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| NetApp |
| T1083 - File and Directory Discovery |
|
Vendor: NetDocs
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| NetDocs |
| T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
Vendor: NetIQ
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| NetIQ |
| T1078 - Valid Accounts |
|
Vendor: NetMotion Wireless
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| NetMotion Wireless |
| T1078 - Valid Accounts T1110 - Brute Force |
|
Vendor: Netskope
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Netskope Security Cloud |
| T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
Vendor: Netwrix
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Netwrix Auditor |
| T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
Vendor: Nortel Contivity
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Nortel Contivity VPN |
| T1078 - Valid Accounts T1110 - Brute Force |
|
Vendor: ObserveIT
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| ObserveIT |
| T1003 - OS Credential Dumping T1078 - Valid Accounts |
|
Vendor: Okta
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Okta Adaptive MFA |
| T1078 - Valid Accounts |
|
Vendor: Onapsis
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Onapsis |
| T1078 - Valid Accounts |
|
Vendor: OneLogin
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| OneLogin |
| T1078 - Valid Accounts |
|
Vendor: Oracle
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Oracle Access Manager |
| T1078 - Valid Accounts |
|
| Oracle Solaris |
| T1003 - OS Credential Dumping |
|
Vendor: Osirium
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Osirium |
| T1078 - Valid Accounts |
|
Vendor: Palo Alto Networks
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Cortex XDR |
| T1078 - Valid Accounts |
|
| GlobalProtect |
| T1078 - Valid Accounts T1110 - Brute Force |
|
| NGFW |
| T1078 - Valid Accounts |
|
| Palo Alto Aperture |
| T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
Vendor: Paxton
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| NET2DOOR |
| T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
Vendor: Perforce
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Perforce |
| T1078 - Valid Accounts |
|
Vendor: Ping Identity
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Ping Identity |
| T1078 - Valid Accounts |
|
| PingOne |
| T1078 - Valid Accounts |
|
Vendor: PowerSentry
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| PowerSentry |
| T1078 - Valid Accounts |
|
Vendor: Procad
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Pro.File DMS |
| T1078 - Valid Accounts |
|
Vendor: ProtectWise
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| NDR |
| T1078 - Valid Accounts |
|
Vendor: Quest InTrust
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Quest InTrust |
| T1003 - OS Credential Dumping |
|
Vendor: RSA
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| RSA NetWitness |
| T1078 - Valid Accounts |
|
| SecurID |
| T1078 - Valid Accounts T1110 - Brute Force |
|
Vendor: RangerAudit
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| RangerAudit |
| T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
Vendor: SAP
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| SAP |
| T1078 - Valid Accounts |
|
Vendor: SSL Open VPN
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Nasuni |
| T1083 - File and Directory Discovery |
|
| SSL Open VPN |
| T1078 - Valid Accounts T1110 - Brute Force |
|
Vendor: Sailpoint
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| IdentityNow |
| T1078 - Valid Accounts |
|
| SecurityIQ |
| T1083 - File and Directory Discovery |
|
Vendor: Salesforce
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Salesforce |
| T1078 - Valid Accounts |
|
Vendor: SecureAuth
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| SecureAuth Login |
| T1078 - Valid Accounts |
|
Vendor: SecureLink
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| SecureLink |
| T1078 - Valid Accounts |
|
Vendor: SecureNet
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| SecureNet |
| T1078 - Valid Accounts T1110 - Brute Force |
|
Vendor: SentinelOne
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| SentinelOne |
| T1003 - OS Credential Dumping T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
Vendor: ServiceNow
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| ServiceNow |
| T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
Vendor: Shibboleth
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Shibboleth SSO |
| T1078 - Valid Accounts |
|
Vendor: Silverfort
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Silverfort |
| T1078 - Valid Accounts |
|
Vendor: SkySea
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| ClientView |
| T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
Vendor: Slack
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| BeyondTrust Secure Remote Access |
| T1078 - Valid Accounts |
|
| Epic SIEM |
| T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
| Exabeam Advanced Analytics |
| T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
| Slack |
| T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
Vendor: Sonicwall
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Sonicwall |
| T1078 - Valid Accounts T1110 - Brute Force |
|
Vendor: Sophos
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Sophos SafeGuard |
| T1078 - Valid Accounts |
|
| Sophos XG Firewall |
| T1078 - Valid Accounts T1110 - Brute Force |
|
Vendor: StealthBits
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| StealthIntercept |
| T1083 - File and Directory Discovery |
|
Vendor: Swift
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Swift |
| T1078 - Valid Accounts |
|
Vendor: Swipes
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Sonicwall |
| T1078 - Valid Accounts T1110 - Brute Force |
|
Vendor: Swivel
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Swivel |
| T1078 - Valid Accounts |
|
Vendor: Symantec
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Symantec CloudSOC |
| T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
| Symantec Endpoint Protection |
| T1078 - Valid Accounts |
|
| Symantec VIP |
| T1078 - Valid Accounts |
|
Vendor: Tanium
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Endpoint Platform |
| T1003 - OS Credential Dumping |
|
Vendor: Thycotic Secret Server
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Thycotic Secret Server |
| T1078 - Valid Accounts |
|
Vendor: Trend Micro
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Deep Discovery Inspector |
| T1078 - Valid Accounts |
|
Vendor: Tyco
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| CCURE Building Management System |
| T1078 - Valid Accounts |
|
Vendor: Unix
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Auditbeat |
| T1003 - OS Credential Dumping T1078 - Valid Accounts |
|
| FTP |
| T1078 - Valid Accounts |
|
| Unix |
| T1003 - OS Credential Dumping T1083 - File and Directory Discovery |
|
| Unix Auditd |
| T1003 - OS Credential Dumping T1083 - File and Directory Discovery |
|
Vendor: VMware
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| VMware Carbon Black App Control |
| T1003 - OS Credential Dumping T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
| VMware Carbon Black Cloud Endpoint Standard |
| T1003 - OS Credential Dumping T1083 - File and Directory Discovery |
|
| VMware Carbon Black EDR |
| T1003 - OS Credential Dumping |
|
| VMware VCenter |
| T1078 - Valid Accounts |
|
| VMware View |
| T1078 - Valid Accounts |
|
Vendor: Varonis
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Data Security Platform |
| T1078 - Valid Accounts T1083 - File and Directory Discovery T1110 - Brute Force |
|
Vendor: Vectra
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Vectra Cognito Detect |
| T1078 - Valid Accounts |
|
Vendor: Vormetric
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Vormetric |
| T1083 - File and Directory Discovery |
|
Vendor: Weblogin
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| NetApp |
| T1083 - File and Directory Discovery |
|
Vendor: Workday
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Workday |
| T1078 - Valid Accounts |
|
Vendor: Xceedium
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Xceedium |
| T1078 - Valid Accounts |
|
Vendor: Zeek
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Zeek Network Security Monitor |
| T1078 - Valid Accounts T1083 - File and Directory Discovery |
|
Vendor: Zlock
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Zlock |
| T1078 - Valid Accounts |
|
Vendor: Zscaler
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| Zscaler Internet Access |
| T1078 - Valid Accounts |
|
| Zscaler Private Access |
| T1078 - Valid Accounts T1110 - Brute Force |
|
Vendor: eDocs
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| eDocs |
| T1078 - Valid Accounts |
|
Vendor: iManage
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| iManage |
| T1078 - Valid Accounts |
|
Vendor: oVirt
| Product | Event Types | MITRE TTP | Content |
|---|---|---|---|
| oVirt |
| T1078 - Valid Accounts |
|