Vendor: Ping Identity

April 15, 2026 · View on GitHub

Product: Ping Identity

RulesModelsMITRE ATT&CK® TTPsActivity TypesParsers
67269651
Use-CaseActivity Types/ParsersMITRE ATT&CK® TTPContent
Abnormal Authentication & Accessapp-activity
pingidentity-pi-json-app-activity-success-deviceadded
pingidentity-pi-json-app-activity-success-deviceunpaired
pingidentity-pi-json-app-activity-apipingone
pingidentity-pi-json-app-activity-apipingone

app-login
pingidentity-pi-cef-app-login-success-pingfederate
pingidentity-pi-str-app-login-success-ssosuccess
pingidentity-pi-kv-app-login-success-sso
pingidentity-pi-cef-app-login-success-sso
pingidentity-pi-cef-app-login-sso-idp
pingidentity-pi-json-app-login-success-ssoidp
pingidentity-pi-json-app-login-ssosession
pingidentity-pi-cef-app-login-password
pingidentity-pi-cef-app-login-sso-session
pingidentity-pi-json-app-activity-apipingone

authentication-failed
pingidentity-pi-str-endpoint-login-fail-tid
pingidentity-pi-str-endpoint-login-fail-oauth
pingidentity-pi-str-endpoint-login-fail-inprogress
pingidentity-pi-json-app-authentication-fail-unsuccessattempt
pingidentity-pi-cef-endpoint-authentication-fail-authnattemptfail
pingidentity-pi-cef-endpoint-authentication-fail-authfailure
pingidentity-pi-cef-endpoint-authentication-fail-failure
pingidentity-pi-cef-endpoint-authentication-fail-failure-1
pingidentity-pi-cef-endpoint-authentication-success-authnsessioncreated
pingidentity-pi-cef-app-authentication-fail-failure-1
pingidentity-pi-json-app-authentication-fail-invalidpasscode
pingidentity-pi-json-app-authentication-fail-pingid
pingidentity-pi-json-app-authentication-fail-user
pingidentity-pi-kv-app-authentication-failure
pingidentity-pi-kv-app-authentication-failure-oauth

authentication-successful
pingidentity-pi-str-endpoint-login-success-oauth
pingidentity-pi-str-endpoint-login-success-authn
pingidentity-pi-kv-app-authentication-success-authnsessionused
pingidentity-pi-cef-app-authentication-success-oauth-1
pingidentity-pi-kv-app-authentication-inprogress
pingidentity-pi-kv-app-authentication-success-oauth
pingidentity-pi-str-app-authentication-success-oauth
pingidentity-pi-cef-app-authentication-success-oauth
pingidentity-pi-cef-app-authentication-success-inprogress-1
pingidentity-pi-str-app-authentication-success-authattempt
pingidentity-pi-kv-app-authentication-oauthinprogress
pingidentity-pi-json-app-authentication-success-pingid
pingidentity-pi-json-app-authentication-success-user
pingidentity-pi-kv-app-authentication-success-authnsesioncreated
pingidentity-pi-kv-app-authentication-success
pingidentity-pi-str-endpoint-login-success-stssuccess
pingidentity-pi-str-endpoint-authentication-success-authsessionused
pingidentity-pi-str-endpoint-authentication-success-authnattemptsuccess
pingidentity-pi-str-endpoint-authentication-success-oauthsuccess
pingidentity-pi-cef-endpoint-authentication-success-authsuccess
pingidentity-pi-cef-endpoint-authentication-success-authenticated
pingidentity-pi-str-endpoint-authentication-success-authnsessioncreated
pingidentity-pi-cef-endpoint-authentication-success-authnsessioncreated
pingidentity-pi-cef-vpn-authentication-success-pingfederate
pingidentity-pi-cef-vpn-authentication-success-authnsessionused
pingidentity-pi-json-vpn-authentication-success-policy
pingidentity-pi-json-vpn-authentication-success-pingid
pingidentity-pi-sk4-app-authentication-success-delivery
pingidentity-pi-sk4-app-authentication-success-queue

failed-app-login
pingidentity-pi-cef-app-login-fail-sso
pingidentity-pi-kv-app-login-failure-sso
pingidentity-pi-str-app-login-fail-ssofailure
pingidentity-pi-cef-app-login-sso-idp
pingidentity-pi-json-app-login-success-ssoidp
pingidentity-pi-json-app-login-ssosession
pingidentity-pi-cef-app-login-password
pingidentity-pi-cef-app-login-sso-session
pingidentity-pi-json-app-activity-apipingone
T1078 - Valid Accounts
T1133 - External Remote Services
  • 15 Rules
  • 4 Models
Account Manipulationapp-activity
pingidentity-pi-json-app-activity-success-deviceadded
pingidentity-pi-json-app-activity-success-deviceunpaired
pingidentity-pi-json-app-activity-apipingone
pingidentity-pi-json-app-activity-apipingone
T1098 - Account Manipulation
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
  • 3 Rules
  • 1 Models
Data Leakapp-activity
pingidentity-pi-json-app-activity-success-deviceadded
pingidentity-pi-json-app-activity-success-deviceunpaired
pingidentity-pi-json-app-activity-apipingone
pingidentity-pi-json-app-activity-apipingone
T1114 - Email Collection
T1114.003 - Email Collection: Email Forwarding Rule
  • 3 Rules
Privilege Escalationapp-activity
pingidentity-pi-json-app-activity-success-deviceadded
pingidentity-pi-json-app-activity-success-deviceunpaired
pingidentity-pi-json-app-activity-apipingone
pingidentity-pi-json-app-activity-apipingone
T1098 - Account Manipulation
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
  • 3 Rules
  • 1 Models
Next Page -->>

MITRE ATT&CK® Framework for Enterprise

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
External Remote Services

Valid Accounts

Exploit Public Fasing Application

External Remote Services

Valid Accounts

Account Manipulation

Account Manipulation: Exchange Email Delegate Permissions

Valid Accounts

Valid Accounts

Email Collection

Email Collection: Email Forwarding Rule

Proxy: Multi-hop Proxy

Proxy