2_ds_absolute_absolute_dds.md

April 15, 2026 · View on GitHub

Use-CaseActivity Types/ParsersMITRE ATT&CK® TTPContent
Compromised Credentialsapp-activity
↳absolute-siemconnector-cef-app-activity-success-deviceuserinformationupdated
↳absolute-siemconnector-cef-app-activity-success-devicelocationupdated
↳absolute-siemconnector-json-app-activity-success-catchall

app-login
↳absolute-siemconnector-cef-app-login-success-loggedin
T1078 - Valid Accounts
T1133 - External Remote Services
T1190 - Exploit Public Fasing Application
  • 42 Rules
  • 24 Models
Data Accessapp-activity
↳absolute-siemconnector-cef-app-activity-success-deviceuserinformationupdated
↳absolute-siemconnector-cef-app-activity-success-devicelocationupdated
↳absolute-siemconnector-json-app-activity-success-catchall

app-login
↳absolute-siemconnector-cef-app-login-success-loggedin
T1078 - Valid Accounts
  • 19 Rules
  • 11 Models
Privilege Abuseapp-activity
↳absolute-siemconnector-cef-app-activity-success-deviceuserinformationupdated
↳absolute-siemconnector-cef-app-activity-success-devicelocationupdated
↳absolute-siemconnector-json-app-activity-success-catchall

app-login
↳absolute-siemconnector-cef-app-login-success-loggedin
T1078 - Valid Accounts
T1098 - Account Manipulation
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
  • 6 Rules
  • 2 Models
Privileged Activityapp-activity
↳absolute-siemconnector-cef-app-activity-success-deviceuserinformationupdated
↳absolute-siemconnector-cef-app-activity-success-devicelocationupdated
↳absolute-siemconnector-json-app-activity-success-catchall

app-login
↳absolute-siemconnector-cef-app-login-success-loggedin
T1078 - Valid Accounts
  • 2 Rules
  • 1 Models