Use Case: Physical Security

July 25, 2023 · View on GitHub

Use Case: Physical Security

Vendor: AMAG

Product	Event Types	MITRE TTP	Content
Symmetry Access Control	failed-physical-access physical-access	T1078 - Valid Accounts	1 Rules

Vendor: AccessIT

Product	Event Types	MITRE TTP	Content
Universal.NET	physical-access	T1078 - Valid Accounts	1 Rules

Vendor: Badge

Product	Event Types	MITRE TTP	Content
Badge	failed-physical-access physical-access	T1078 - Valid Accounts	1 Rules

Vendor: Badgepoint

Product	Event Types	MITRE TTP	Content
Badgepoint	failed-physical-access physical-access	T1078 - Valid Accounts	1 Rules

Vendor: Brivo

Product	Event Types	MITRE TTP	Content
Brivo	failed-physical-access physical-access	T1078 - Valid Accounts	1 Rules

Vendor: Datawatch Systems

Product	Event Types	MITRE TTP	Content
DataWatch	failed-physical-access physical-access	T1078 - Valid Accounts	1 Rules

Vendor: Galaxy

Product	Event Types	MITRE TTP	Content
Galaxy	failed-physical-access physical-access	T1078 - Valid Accounts	1 Rules

Vendor: Generic Badge Access

Product	Event Types	MITRE TTP	Content
Generic Badge Access	failed-physical-access physical-access	T1078 - Valid Accounts	1 Rules

Vendor: Honeywell

Product	Event Types	MITRE TTP	Content
Honeywell Pro-Watch	failed-physical-access physical-access	T1078 - Valid Accounts	1 Rules
Honeywell WIN-PAK	physical-access	T1078 - Valid Accounts	1 Rules
honeywell siama	physical-access	T1078 - Valid Accounts	1 Rules

Vendor: ICPAM

Product	Event Types	MITRE TTP	Content
ICPAM	physical-access	T1078 - Valid Accounts	1 Rules

Vendor: Johnson Controls

Product	Event Types	MITRE TTP	Content
Johnson Controls P2000	account-password-change-failed app-login failed-logon physical-access security-alert	T1078 - Valid Accounts	1 Rules

Vendor: KABA EXOS

Product	Event Types	MITRE TTP	Content
KABA EXOS	physical-access	T1078 - Valid Accounts	1 Rules

Vendor: Lenel

Product	Event Types	MITRE TTP	Content
Lenel OnGuard	failed-physical-access physical-access	T1078 - Valid Accounts	1 Rules
OnGuard	failed-physical-access physical-access	T1078 - Valid Accounts	1 Rules

Vendor: Lyrix

Product	Event Types	MITRE TTP	Content
Lyrix	failed-physical-access physical-access	T1078 - Valid Accounts	1 Rules

Vendor: Paxton

Product	Event Types	MITRE TTP	Content
NET2DOOR	account-password-change account-password-change-failed app-activity app-activity-failed app-login authentication-failed authentication-successful failed-app-login failed-physical-access file-delete file-download file-read file-upload file-write physical-access	T1078 - Valid Accounts	1 Rules

Vendor: PicturePerfect

Product	Event Types	MITRE TTP	Content
PicturePerfect	physical-access	T1078 - Valid Accounts	1 Rules

Vendor: RS2

Product	Event Types	MITRE TTP	Content
RS2	failed-physical-access physical-access	T1078 - Valid Accounts	1 Rules
RS2 Technologies	failed-physical-access physical-access	T1078 - Valid Accounts	1 Rules

Vendor: RedCloud

Product	Event Types	MITRE TTP	Content
RedCloud	failed-physical-access physical-access	T1078 - Valid Accounts	1 Rules

Vendor: SecurityExpert

Product	Event Types	MITRE TTP	Content
SecurityExpert	physical-access	T1078 - Valid Accounts	1 Rules

Vendor: Sensormatik

Product	Event Types	MITRE TTP	Content
Sensormatik	failed-physical-access physical-access	T1078 - Valid Accounts	1 Rules

Vendor: Siemens

Product	Event Types	MITRE TTP	Content
Siemens	failed-physical-access physical-access	T1078 - Valid Accounts	1 Rules

Vendor: Slack

Product	Event Types	MITRE TTP	Content
Epic SIEM	app-activity failed-physical-access file-delete file-write physical-access	T1078 - Valid Accounts	1 Rules

Vendor: Swipes

Product	Event Types	MITRE TTP	Content
Swipes	physical-access	T1078 - Valid Accounts	1 Rules

Vendor: TimeLox

Product	Event Types	MITRE TTP	Content
Honeywell Pro-Watch	failed-physical-access physical-access	T1078 - Valid Accounts	1 Rules
TimeLox	failed-physical-access physical-access	T1078 - Valid Accounts	1 Rules

Vendor: Tyco

Product	Event Types	MITRE TTP	Content
CCURE Building Management System	app-activity app-login failed-physical-access physical-access	T1078 - Valid Accounts	1 Rules
Symmetry Access Control	failed-physical-access physical-access	T1078 - Valid Accounts	1 Rules

Vendor: Vanderbilt

Product	Event Types	MITRE TTP	Content
Vanderbilt	failed-physical-access physical-access	T1078 - Valid Accounts	1 Rules

Vendor: Viscount

Product	Event Types	MITRE TTP	Content
Viscount	failed-physical-access physical-access	T1078 - Valid Accounts	1 Rules

Vendor: Visma

Product	Event Types	MITRE TTP	Content
Megaflex	failed-physical-access physical-access	T1078 - Valid Accounts	1 Rules