2_ds_thoughtspot_thoughtspot.md

April 15, 2026 · View on GitHub

Use-Case	Activity Types/Parsers	MITRE ATT&CK® TTP	Content
Compromised Credentials	app-activity ↳thoughtspot-ts-json-app-activity-success-type ↳thoughtspot-ts-json-app-activity-success-type ↳thoughtspot-ts-json-app-activity-success-type app-login ↳thoughtspot-ts-json-app-activity-success-type failed-app-login ↳thoughtspot-ts-json-app-activity-success-type	T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application	43 Rules 24 Models
Data Access	app-activity ↳thoughtspot-ts-json-app-activity-success-type ↳thoughtspot-ts-json-app-activity-success-type ↳thoughtspot-ts-json-app-activity-success-type app-login ↳thoughtspot-ts-json-app-activity-success-type failed-app-login ↳thoughtspot-ts-json-app-activity-success-type	T1078 - Valid Accounts	20 Rules 11 Models
Privilege Abuse	account-creation ↳thoughtspot-ts-json-app-activity-success-type account-deleted ↳thoughtspot-ts-json-app-activity-success-type account-password-change ↳thoughtspot-ts-json-app-activity-success-type app-activity ↳thoughtspot-ts-json-app-activity-success-type ↳thoughtspot-ts-json-app-activity-success-type ↳thoughtspot-ts-json-app-activity-success-type app-login ↳thoughtspot-ts-json-app-activity-success-type failed-app-login ↳thoughtspot-ts-json-app-activity-success-type	T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002 T1531 - Account Access Removal	25 Rules 9 Models
Privileged Activity	app-activity ↳thoughtspot-ts-json-app-activity-success-type ↳thoughtspot-ts-json-app-activity-success-type ↳thoughtspot-ts-json-app-activity-success-type app-login ↳thoughtspot-ts-json-app-activity-success-type failed-app-login ↳thoughtspot-ts-json-app-activity-success-type	T1078 - Valid Accounts	2 Rules 1 Models