Vendor: Google
July 25, 2023 · View on GitHub
Product: Google
Use-Case: Data Access
| Rules | Models | MITRE TTPs | Event Types | Parsers |
|---|---|---|---|---|
| 15 | 9 | 1 | 3 | 3 |
| Event Type | Rules | Models |
|---|---|---|
| app-activity | T1078 - Valid Accounts ↳ APP-AppU-F: First login to an application for a user with no history ↳ APP-AppG-F: First login to an application for group ↳ APP-GApp-A: Abnormal login to an application for group ↳ APP-UAg-3: More than two new user agents used by the user in the same session ↳ APP-UOb-F: First access to application object for user ↳ APP-UOb-A: Abnormal access to application object for user ↳ APP-AA-F: First application activity in the organization ↳ APP-AA-A: Abnormal activity in application for the organization ↳ APP-UMime-F: First mime type for user ↳ APP-UMime-A: Abnormal mime type for user ↳ APP-GMime-F: First mime type for peer group ↳ APP-GMime-A: Abnormal mime type for peer group ↳ APP-OMime-F: First mime type for organization ↳ APP-OMime-A: Abnormal mime type for organization | • APP-OMime: Mime types for organization • APP-GMime: Mime types per peer group • APP-UMime: Mime types per user • APP-AA: Activity per application • APP-UOb: Application objects per user • APP-UAg: User Agent Strings • APP-GApp: Group Logons to Applications • APP-AppG: Groups per Application • APP-AppU: User Logons to Applications |
| app-login | T1078 - Valid Accounts ↳ APP-AppU-F: First login to an application for a user with no history ↳ APP-AppG-F: First login to an application for group ↳ APP-GApp-A: Abnormal login to an application for group ↳ APP-UAg-3: More than two new user agents used by the user in the same session | • APP-UAg: User Agent Strings • APP-GApp: Group Logons to Applications • APP-AppG: Groups per Application • APP-AppU: User Logons to Applications |
| failed-app-login | T1078 - Valid Accounts ↳ APP-F-FL: Failed login to application |