Vendor: ThoughtSpot

April 15, 2026 · View on GitHub

Product: ThoughtSpot

RulesModelsMITRE ATT&CK® TTPsActivity TypesParsers
89331361
Use-CaseActivity Types/ParsersMITRE ATT&CK® TTPContent
Abnormal Authentication & Accessaccount-creation
thoughtspot-ts-json-app-activity-success-type

account-deleted
thoughtspot-ts-json-app-activity-success-type

account-password-change
thoughtspot-ts-json-app-activity-success-type

app-activity
thoughtspot-ts-json-app-activity-success-type
thoughtspot-ts-json-app-activity-success-type
thoughtspot-ts-json-app-activity-success-type

app-login
thoughtspot-ts-json-app-activity-success-type

failed-app-login
thoughtspot-ts-json-app-activity-success-type
T1078 - Valid Accounts
T1133 - External Remote Services
  • 15 Rules
  • 4 Models
Account Manipulationaccount-creation
thoughtspot-ts-json-app-activity-success-type

account-deleted
thoughtspot-ts-json-app-activity-success-type

account-password-change
thoughtspot-ts-json-app-activity-success-type

app-activity
thoughtspot-ts-json-app-activity-success-type
thoughtspot-ts-json-app-activity-success-type
thoughtspot-ts-json-app-activity-success-type
T1098 - Account Manipulation
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
T1136 - Create Account
T1136.001 - Create Account: Create: Local Account
T1136.002 - T1136.002
T1531 - Account Access Removal
  • 25 Rules
  • 9 Models
Data Leakapp-activity
thoughtspot-ts-json-app-activity-success-type
thoughtspot-ts-json-app-activity-success-type
thoughtspot-ts-json-app-activity-success-type
T1114 - Email Collection
T1114.003 - Email Collection: Email Forwarding Rule
  • 3 Rules
Lateral Movementapp-login
thoughtspot-ts-json-app-activity-success-type

failed-app-login
thoughtspot-ts-json-app-activity-success-type
T1078 - Valid Accounts
T1090 - Proxy
T1090.003 - Proxy: Multi-hop Proxy
  • 2 Rules
Malwareapp-login
thoughtspot-ts-json-app-activity-success-type
T1078 - Valid Accounts
  • 1 Rules
Privilege Escalationapp-activity
thoughtspot-ts-json-app-activity-success-type
thoughtspot-ts-json-app-activity-success-type
thoughtspot-ts-json-app-activity-success-type
T1098 - Account Manipulation
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
  • 3 Rules
  • 1 Models
Ransomwareapp-login
thoughtspot-ts-json-app-activity-success-type

failed-app-login
thoughtspot-ts-json-app-activity-success-type
T1078 - Valid Accounts
  • 2 Rules
Next Page -->>

MITRE ATT&CK® Framework for Enterprise

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
External Remote Services

Valid Accounts

Exploit Public Fasing Application

Create Account

External Remote Services

Valid Accounts

Account Manipulation

Create Account: Create: Local Account

Account Manipulation: Exchange Email Delegate Permissions

Valid Accounts

Valid Accounts

Email Collection

Email Collection: Email Forwarding Rule

Proxy: Multi-hop Proxy

Proxy

Account Access Removal