2_ds_proofpoint_proofpoint_casb.md

April 15, 2026 · View on GitHub

Use-CaseActivity Types/ParsersMITRE ATT&CK® TTPContent
Lateral Movementsecurity-alert
↳proofpoint-casb-json-alert-trigger-success-suspiciouslogin
↳proofpoint-casb-json-alert-trigger-success-suspiciouslogin
↳proofpoint-casb-json-alert-trigger-success-severity
↳proofpoint-casb-json-alert-trigger-success-severity
T1027 - Obfuscated Files or Information
T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools
  • 2 Rules
Malwaredlp-alert
↳proofpoint-casb-json-alert-trigger-success-dataleakage
↳proofpoint-casb-json-alert-trigger-success-dataleakage

security-alert
↳proofpoint-casb-json-alert-trigger-success-suspiciouslogin
↳proofpoint-casb-json-alert-trigger-success-suspiciouslogin
↳proofpoint-casb-json-alert-trigger-success-severity
↳proofpoint-casb-json-alert-trigger-success-severity
TA0002 - TA0002
  • 4 Rules
  • 2 Models
Privileged Activitysecurity-alert
↳proofpoint-casb-json-alert-trigger-success-suspiciouslogin
↳proofpoint-casb-json-alert-trigger-success-suspiciouslogin
↳proofpoint-casb-json-alert-trigger-success-severity
↳proofpoint-casb-json-alert-trigger-success-severity
T1068 - Exploitation for Privilege Escalation
  • 1 Rules