Vendor: Cisco

April 15, 2026 · View on GitHub

Product: Cisco Collaboration

RulesModelsMITRE ATT&CK® TTPsActivity TypesParsers
77291052
Use-CaseActivity Types/ParsersMITRE ATT&CK® TTPContent
Abnormal Authentication & Accessauthentication-failed
cisco-cucm-kv-endpoint-authentication-fail-userlogging

authentication-successful
cisco-cucm-kv-endpoint-login-success-authsuccess
cisco-cucm-kv-endpoint-login-success-authsuccess-1

member-added
cisco-gateway-str-group-member-add-success-confd

vpn-login
cisco-gateway-str-vpn-login-success-assignedtosession
T1078 - Valid Accounts
T1133 - External Remote Services
  • 16 Rules
  • 5 Models
Account Manipulationmember-added
cisco-gateway-str-group-member-add-success-confd
T1098 - Account Manipulation
T1136 - Create Account
  • 24 Rules
  • 12 Models
Physical Securityvpn-login
cisco-gateway-str-vpn-login-success-assignedtosession
T1133 - External Remote Services
  • 1 Rules
  • 1 Models
Privilege Abusemember-added
cisco-gateway-str-group-member-add-success-confd

vpn-login
cisco-gateway-str-vpn-login-success-assignedtosession
T1078 - Valid Accounts
T1098 - Account Manipulation
T1133 - External Remote Services
T1136 - Create Account
  • 25 Rules
  • 12 Models
Next Page -->>

MITRE ATT&CK® Framework for Enterprise

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
External Remote Services

Valid Accounts

Exploit Public Fasing Application

Create Account

External Remote Services

Valid Accounts

Account Manipulation

Valid Accounts

Obfuscated Files or Information: Indicator Removal from Tools

Valid Accounts

Obfuscated Files or Information

Proxy: Multi-hop Proxy

Proxy