2_ds_smartsuite_smartsuite.md

April 15, 2026 · View on GitHub

Use-CaseActivity Types/ParsersMITRE ATT&CK® TTPContent
Privilege Abuseaccount-creation
smartsuite-ssuite-json-audit-event

account-deleted
smartsuite-ssuite-json-audit-event

app-activity
smartsuite-ssuite-json-audit-event
smartsuite-ssuite-json-audit-event
smartsuite-ssuite-json-audit-event
smartsuite-ssuite-json-app-activity-success

member-added
smartsuite-ssuite-json-audit-event

member-removed
smartsuite-ssuite-json-audit-event
T1078 - Valid Accounts
T1098 - Account Manipulation
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
T1136 - Create Account
T1136.001 - Create Account: Create: Local Account
T1136.002 - T1136.002
T1531 - Account Access Removal
  • 46 Rules
  • 19 Models