uc_data_exfiltration.md

Use Case: Data Exfiltration

Vendor: Accellion

Product	Event Types	MITRE ATT&CK® TTP	Content
Kiteworks	account-lockout account-password-change account-password-reset account-unlocked app-activity app-login dlp-alert dlp-email-alert-out failed-app-login file-delete file-download file-permission-change file-read file-upload file-write	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0002 - TA0002 TA0010 - TA0010	31 Rules 19 Models

Vendor: Airlock

Product	Event Types	MITRE ATT&CK® TTP	Content
Web Application Firewall	app-activity-failed app-login failed-app-login file-delete file-download file-upload file-write network-connection-failed network-connection-successful vpn-logout	T1133 - External Remote Services TA0002 - TA0002 TA0010 - TA0010	6 Rules 5 Models

Vendor: Akamai

Product	Event Types	MITRE ATT&CK® TTP	Content
Cloud Akamai	web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models

Vendor: Amazon

Product	Event Types	MITRE ATT&CK® TTP	Content
AWS CloudWatch	netflow-connection	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1071.002 - Application Layer Protocol: File Transfer Protocols	1 Rules
AWS WAF	web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models

Vendor: Apache

Product	Event Types	MITRE ATT&CK® TTP	Content
Apache	web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models

Vendor: AssetView

Product	Event Types	MITRE ATT&CK® TTP	Content
AssetView	file-download file-write print-activity security-alert usb-insert	TA0002 - TA0002	2 Rules 1 Models

Vendor: Barracuda

Product	Event Types	MITRE ATT&CK® TTP	Content
Barracuda Firewall	failed-vpn-login network-connection-failed network-connection-successful remote-logon vpn-login vpn-logout	T1133 - External Remote Services TA0010 - TA0010	4 Rules 4 Models

Vendor: BeyondTrust

Product	Event Types	MITRE ATT&CK® TTP	Content
BeyondTrust PowerBroker	privileged-access process-created	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling	13 Rules
BeyondTrust Privilege Management	local-logon process-created	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling	13 Rules

Vendor: Bitdefender

Product	Event Types	MITRE ATT&CK® TTP	Content
GravityZone	app-login security-alert web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	6 Rules 2 Models

Vendor: Bitglass

Product	Event Types	MITRE ATT&CK® TTP	Content
Bitglass CASB	app-login dlp-alert dlp-email-alert-out failed-app-login file-download file-read file-write	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0002 - TA0002 TA0010 - TA0010	31 Rules 19 Models

Vendor: BlackBerry

Product	Event Types	MITRE ATT&CK® TTP	Content
BlackBerry Protect	app-activity app-login dlp-alert file-alert process-alert security-alert	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0002 - TA0002 TA0010 - TA0010	31 Rules 19 Models

Vendor: Box

Product	Event Types	MITRE ATT&CK® TTP	Content
Box Cloud Content Management	app-activity app-login file-delete file-download file-permission-change file-read file-upload file-write	TA0002 - TA0002	2 Rules 1 Models

Vendor: Bromium

Product	Event Types	MITRE ATT&CK® TTP	Content
Bromium Secure Platform	file-permission-change file-read file-write	TA0002 - TA0002	2 Rules 1 Models

Vendor: Carbon Black EDR

Product	Event Types	MITRE ATT&CK® TTP	Content
Carbon Black EDR	file-alert	TA0002 - TA0002	2 Rules 1 Models

Vendor: CatoNetworks

Product	Event Types	MITRE ATT&CK® TTP	Content
Cato Cloud	network-alert vpn-connection vpn-login vpn-logout web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1133 - External Remote Services T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms TA0010 - TA0010	12 Rules 6 Models

Vendor: Check Point

Product	Event Types	MITRE ATT&CK® TTP	Content
Avanan	dlp-alert dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed security-alert	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010	29 Rules 18 Models
Identity Awareness	failed-vpn-login network-connection-failed network-connection-successful vpn-login vpn-logout	T1133 - External Remote Services TA0010 - TA0010	4 Rules 4 Models
NGFW	app-login authentication-failed authentication-successful dlp-email-alert-in dlp-email-alert-out failed-vpn-login local-logon network-alert network-connection-failed network-connection-successful vpn-connection vpn-login vpn-logout web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1133 - External Remote Services T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms TA0010 - TA0010	12 Rules 6 Models
Security Gateway	failed-vpn-login vpn-login vpn-logout	T1133 - External Remote Services TA0010 - TA0010	4 Rules 4 Models

Vendor: Cimtrak

Product	Event Types	MITRE ATT&CK® TTP	Content
Cimtrak	file-delete file-write	TA0002 - TA0002	2 Rules 1 Models

Vendor: Cisco

Product	Event Types	MITRE ATT&CK® TTP	Content
ADC	web-activity-allowed	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	7 Rules 2 Models
Adaptive Security Appliance	authentication-failed authentication-successful dns-response failed-logon failed-vpn-login file-download file-upload nac-logon network-connection-successful process-created remote-logon vpn-login vpn-logout web-activity-denied	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1133 - External Remote Services T1552.001 - T1552.001 T1560 - Archive Collected Data T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms T1572 - Protocol Tunneling TA0010 - TA0010	23 Rules 6 Models
AnyConnect	process-network vpn-login vpn-logout	T1133 - External Remote Services TA0010 - TA0010	4 Rules 4 Models
Cloud Web Security	web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models
CloudLock	dlp-alert	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010	29 Rules 18 Models
Firepower	authentication-successful dns-query dns-response failed-vpn-login file-download nac-logon netflow-connection network-alert network-connection-failed network-connection-successful process-created security-alert vpn-login vpn-logout web-activity-allowed web-activity-denied	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1133 - External Remote Services T1552.001 - T1552.001 T1560 - Archive Collected Data T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms T1572 - Protocol Tunneling TA0010 - TA0010	26 Rules 6 Models
ISE	app-activity authentication-failed authentication-successful computer-logon config-change failed-logon failed-vpn-login nac-failed-logon nac-logon remote-logon vpn-login vpn-logout	T1133 - External Remote Services TA0010 - TA0010	4 Rules 4 Models
IronPort Web Security	web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models
Meraki MX appliances	network-alert network-connection-failed network-connection-successful vpn-login vpn-logout web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1133 - External Remote Services T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms TA0010 - TA0010	12 Rules 6 Models
NPE	process-created	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling	13 Rules
Netflow	netflow-connection	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1071.002 - Application Layer Protocol: File Transfer Protocols	1 Rules
Proxy Umbrella	network-connection-successful web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models
Secure Web Appliance	web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models
TACACS	authentication-failed process-created	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling	13 Rules
Umbrella	dns-response web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models

Vendor: Citrix

Product	Event Types	MITRE ATT&CK® TTP	Content
Citrix Netscaler	app-login authentication-failed failed-vpn-login process-created vpn-login vpn-logout	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1133 - External Remote Services T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling TA0010 - TA0010	17 Rules 4 Models
Citrix Netscaler VPN	authentication-failed authentication-successful remote-access remote-logon vpn-connection vpn-logout web-activity-allowed	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1133 - External Remote Services T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms TA0010 - TA0010	11 Rules 6 Models
Web Logging	web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models

Vendor: Cloudflare

Product	Event Types	MITRE ATT&CK® TTP	Content
Cloudflare WAF	network-alert network-connection-failed network-connection-successful web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models

Vendor: Code42

Product	Event Types	MITRE ATT&CK® TTP	Content
Code42 Incydr	app-activity dlp-email-alert-out file-delete file-download file-read file-upload file-write print-activity security-alert usb-activity usb-insert	TA0002 - TA0002	2 Rules 1 Models

Vendor: CrowdStrike

Product	Event Types	MITRE ATT&CK® TTP	Content
Falcon	app-activity app-activity-failed app-login authentication-failed batch-logon computer-logon config-change dlp-alert dns-query failed-app-login file-alert file-delete file-download file-read file-write local-logon network-connection-successful process-alert process-created process-network remote-access remote-logon security-alert service-logon task-created usb-activity usb-insert usb-write workstation-unlocked	T1003 - OS Credential Dumping T1020 - Automated Exfiltration T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling TA0002 - TA0002 TA0010 - TA0010	44 Rules 19 Models

Vendor: CyberArk

Product	Event Types	MITRE ATT&CK® TTP	Content
CyberArk Vault	account-password-change account-password-change-failed account-password-reset account-switch app-activity app-activity-failed app-login failed-app-login failed-logon file-delete file-permission-change file-read file-write remote-logon security-alert	TA0002 - TA0002	2 Rules 1 Models

Vendor: Delinea

Product	Event Types	MITRE ATT&CK® TTP	Content
Centrify Audit and Monitoring Service	file-delete file-read file-write	TA0002 - TA0002	2 Rules 1 Models
Centrify Infrastructure Services	process-created	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling	13 Rules

Vendor: Dell

Product	Event Types	MITRE ATT&CK® TTP	Content
EMC Isilon	file-delete file-permission-change file-read file-write remote-access	TA0002 - TA0002	2 Rules 1 Models
SonicWALL Aventail	vpn-login vpn-logout	T1133 - External Remote Services TA0010 - TA0010	4 Rules 4 Models

Vendor: Digital Arts

Product	Event Types	MITRE ATT&CK® TTP	Content
Digital Arts i-FILTER for Business	web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models

Vendor: Digital Guardian

Product	Event Types	MITRE ATT&CK® TTP	Content
Digital Guardian Endpoint Protection	app-activity app-login dlp-email-alert-out file-delete file-download file-read file-upload file-write local-logon network-connection-failed network-connection-successful print-activity process-created usb-insert usb-write	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling TA0002 - TA0002	15 Rules 1 Models
Digital Guardian Network DLP	dlp-alert dlp-email-alert-out dlp-email-alert-out-failed	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010	29 Rules 18 Models

Vendor: Dropbox

Product	Event Types	MITRE ATT&CK® TTP	Content
Dropbox	app-activity app-login file-delete file-download file-permission-change file-read file-write vpn-logout	T1133 - External Remote Services TA0002 - TA0002 TA0010 - TA0010	6 Rules 5 Models

Vendor: Dtex Systems

Product	Event Types	MITRE ATT&CK® TTP	Content
DTEX InTERCEPT	file-delete file-read file-write local-logon print-activity process-created remote-logon usb-write web-activity-allowed workstation-locked workstation-unlocked	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms T1572 - Protocol Tunneling TA0002 - TA0002	22 Rules 3 Models

Vendor: ESET

Product	Event Types	MITRE ATT&CK® TTP	Content
ESET Endpoint Security	app-login authentication-failed authentication-successful failed-logon network-alert security-alert web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	6 Rules 2 Models

Vendor: ESector

Product	Event Types	MITRE ATT&CK® TTP	Content
ESector DEFESA	file-delete file-read file-write	TA0002 - TA0002	2 Rules 1 Models

Vendor: EdgeWave

Product	Event Types	MITRE ATT&CK® TTP	Content
EdgeWave iPrism	web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models

Vendor: Egnyte

Product	Event Types	MITRE ATT&CK® TTP	Content
Egnyte	app-activity app-login failed-app-login file-delete file-download file-permission-change file-upload file-write	TA0002 - TA0002	2 Rules 1 Models

Vendor: EndPoint

Product	Event Types	MITRE ATT&CK® TTP	Content
EndPoint	dlp-alert	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010	29 Rules 18 Models

Vendor: F5

Product	Event Types	MITRE ATT&CK® TTP	Content
F5 Advanced Web Application Firewall (WAF)	account-switch dlp-email-alert-out network-alert network-connection-failed network-connection-successful process-created remote-logon	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling	13 Rules
F5 BIG-IP	account-password-change-failed authentication-failed authentication-successful failed-logon failed-vpn-login network-connection-successful remote-logon vpn-login vpn-logout	T1133 - External Remote Services TA0010 - TA0010	4 Rules 4 Models
F5 BIG-IP Access Policy Manager (APM)	authentication-failed authentication-successful vpn-login vpn-logout	T1133 - External Remote Services TA0010 - TA0010	4 Rules 4 Models
F5 BIG-IP Application Security Manager (ASM)	security-alert web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models
WebSafe	web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models

Vendor: FTP

Product	Event Types	MITRE ATT&CK® TTP	Content
FTP	app-activity app-activity-failed app-login failed-app-login file-delete file-read file-write	TA0002 - TA0002	2 Rules 1 Models

Vendor: FileAuditor

Product	Event Types	MITRE ATT&CK® TTP	Content
FileAuditor	file-delete file-read file-write	TA0002 - TA0002	2 Rules 1 Models

Vendor: FireEye

Product	Event Types	MITRE ATT&CK® TTP	Content
FireEye Endpoint Security (HX)	file-write network-alert process-alert security-alert	TA0002 - TA0002	2 Rules 1 Models
FireEye Network Security (NX)	security-alert web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models

Vendor: Forcepoint

Product	Event Types	MITRE ATT&CK® TTP	Content
Forcepoint DLP	dlp-alert dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed usb-insert	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010	29 Rules 18 Models
Forcepoint Insider Threat	dlp-alert	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010	29 Rules 18 Models
Websense Secure Gateway	web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models

Vendor: Fortinet

Product	Event Types	MITRE ATT&CK® TTP	Content
FortiGate	network-connection-successful vpn-connection web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models
Fortinet Enterprise Firewall	app-activity app-activity-failed computer-logon netflow-connection network-connection-failed network-connection-successful	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1071.002 - Application Layer Protocol: File Transfer Protocols	1 Rules
Fortinet FortiWeb	web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models
Fortinet UTM	app-activity app-activity-failed authentication-failed authentication-successful dlp-alert dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed network-alert security-alert web-activity-allowed web-activity-denied	T1020 - Automated Exfiltration T1041 - Exfiltration Over C2 Channel T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms TA0010 - TA0010	37 Rules 20 Models
Fortinet VPN	authentication-successful failed-vpn-login vpn-login vpn-logout	T1133 - External Remote Services TA0010 - TA0010	4 Rules 4 Models

Vendor: GTB

Product	Event Types	MITRE ATT&CK® TTP	Content
GTBInspector	dlp-alert	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010	29 Rules 18 Models

Vendor: Google

Product	Event Types	MITRE ATT&CK® TTP	Content
Cloud Platform	app-activity cloud-admin-activity cloud-admin-activity-failed gcp-disk-attach gcp-disk-create gcp-image-create gcp-instance-create gcp-instance-setmachinetype gcp-instance-setmetadata gcp-policy-write gcp-role-write gcp-serviceaccount-creds-write gcp-serviceaccount-write gcp-snapshot-create gcp-storageobject-acl netflow-connection network-alert storage-access storage-activity storage-activity-failed web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	9 Rules 2 Models
Workspace	account-password-change account-password-reset app-activity app-login dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed failed-app-login file-delete file-download file-permission-change file-read file-upload file-write	TA0002 - TA0002	2 Rules 1 Models

Vendor: HP

Product	Event Types	MITRE ATT&CK® TTP	Content
HP Comware	process-created	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling	13 Rules

Vendor: HashiCorp

Product	Event Types	MITRE ATT&CK® TTP	Content
Terraform	web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models

Vendor: HelpSystems

Product	Event Types	MITRE ATT&CK® TTP	Content
Powertech Identity Access Manager (BoKs)	account-switch file-delete file-read file-write local-logon process-created remote-logon	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling TA0002 - TA0002	15 Rules 1 Models

Vendor: Huawei

Product	Event Types	MITRE ATT&CK® TTP	Content
Unified Security Gateway	authentication-successful network-alert process-created vpn-login	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling	13 Rules

Vendor: IBM

Product	Event Types	MITRE ATT&CK® TTP	Content
IBM Security Access Manager	web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models
Infosphere Guardium	database-alert database-failed-login database-login database-query	TA0002 - TA0002	2 Rules 1 Models

Vendor: IMSS

Product	Event Types	MITRE ATT&CK® TTP	Content
IMSS	dlp-alert security-alert	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010	29 Rules 18 Models

Vendor: Imperva

Product	Event Types	MITRE ATT&CK® TTP	Content
CounterBreach	database-alert	TA0002 - TA0002	2 Rules 1 Models
Imperva File Activity Monitoring (FAM)	file-delete file-permission-change file-read file-write	TA0002 - TA0002	2 Rules 1 Models
Imperva SecureSphere	app-login database-alert database-delete database-failed-login database-login database-query database-update failed-app-login network-alert security-alert	TA0002 - TA0002	2 Rules 1 Models
Incapsula	web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models

Vendor: InfoWatch

Product	Event Types	MITRE ATT&CK® TTP	Content
InfoWatch	app-login dlp-email-alert-in dlp-email-alert-out print-activity usb-write web-activity-allowed	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	7 Rules 2 Models

Vendor: Infoblox

Product	Event Types	MITRE ATT&CK® TTP	Content
BloxOne	computer-logon dns-query dns-response file-write network-alert network-connection-failed network-connection-successful remote-logon vpn-connection	TA0002 - TA0002	2 Rules 1 Models

Vendor: Ipswitch

Product	Event Types	MITRE ATT&CK® TTP	Content
IPswitch MoveIt	app-activity app-login failed-app-login file-read file-write	TA0002 - TA0002	2 Rules 1 Models
MoveIt DMZ	account-password-change authentication-failed authentication-successful failed-logon file-delete file-download file-upload file-write member-added	TA0002 - TA0002	2 Rules 1 Models

Vendor: Juniper Networks

Product	Event Types	MITRE ATT&CK® TTP	Content
Juniper Networks	config-change process-created	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling	13 Rules
Juniper Networks Pulse Secure	account-deleted app-activity authentication-failed authentication-successful failed-vpn-login network-connection-failed vpn-connection vpn-login vpn-logout	T1133 - External Remote Services TA0010 - TA0010	4 Rules 4 Models
Juniper SRX	authentication-successful failed-vpn-login network-alert network-connection-failed network-connection-successful security-alert vpn-login web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models
Juniper VPN	account-deleted authentication-failed authentication-successful failed-vpn-login vpn-login vpn-logout web-activity-allowed	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1133 - External Remote Services T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms TA0010 - TA0010	11 Rules 6 Models

Vendor: Kaspersky

Product	Event Types	MITRE ATT&CK® TTP	Content
Kaspersky AV	dlp-email-alert-in file-alert security-alert	TA0002 - TA0002	2 Rules 1 Models
Kaspersky Endpoint Security for Business	dlp-alert network-alert security-alert usb-insert	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010	29 Rules 18 Models

Vendor: LOGBinder

Product	Event Types	MITRE ATT&CK® TTP	Content
SharePoint	app-activity file-read file-write	TA0002 - TA0002	2 Rules 1 Models

Vendor: LanScope

Product	Event Types	MITRE ATT&CK® TTP	Content
LanScope Cat	app-activity dlp-alert failed-usb-activity file-delete file-write local-logon print-activity process-created process-created-failed process-network usb-activity usb-write web-activity-allowed workstation-locked workstation-unlocked	T1003 - OS Credential Dumping T1020 - Automated Exfiltration T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms T1572 - Protocol Tunneling TA0002 - TA0002 TA0010 - TA0010	51 Rules 21 Models

Vendor: LogRhythm

Product	Event Types	MITRE ATT&CK® TTP	Content
LogRhythm	process-created	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling	13 Rules

Vendor: Malwarebytes

Product	Event Types	MITRE ATT&CK® TTP	Content
Malwarebytes Endpoint Protection	network-alert security-alert web-activity-denied	T1071.001 - Application Layer Protocol: Web Protocols T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	6 Rules 2 Models

Vendor: McAfee

Product	Event Types	MITRE ATT&CK® TTP	Content
MDAM	database-alert database-delete database-query database-update	TA0002 - TA0002	2 Rules 1 Models
McAfee Advanced Threat Defense	dlp-alert	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010	29 Rules 18 Models
McAfee DLP	dlp-alert dlp-email-alert-out dlp-email-alert-out-failed failed-usb-activity print-activity usb-insert usb-write	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010	29 Rules 18 Models
McAfee Endpoint Security	dlp-alert file-write process-alert process-created-failed remote-logon security-alert usb-activity usb-insert usb-write	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0002 - TA0002 TA0010 - TA0010	31 Rules 19 Models
McAfee Web Gateway	web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models
Skyhigh Networks CASB	app-activity app-login dlp-alert failed-app-login file-download security-alert	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010	29 Rules 18 Models

Vendor: Microsoft

Product	Event Types	MITRE ATT&CK® TTP	Content
Azure	account-password-change app-activity app-activity-failed app-login authentication-failed authentication-successful cloud-admin-activity cloud-admin-activity-failed database-query dns-query failed-app-login file-delete file-download file-read file-upload file-write image-loaded member-added member-removed network-alert network-connection-failed network-connection-successful process-created remote-logon security-alert storage-access storage-activity storage-activity-failed usb-activity usb-insert	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling TA0002 - TA0002	15 Rules 1 Models
Azure Security Center	database-alert dlp-alert network-alert process-alert security-alert	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0002 - TA0002 TA0010 - TA0010	31 Rules 19 Models
Cloud App Security (MCAS)	account-password-change account-password-reset app-activity app-login dlp-alert failed-app-login file-delete file-download file-read file-upload file-write security-alert	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0002 - TA0002 TA0010 - TA0010	31 Rules 19 Models
Defender ATP	app-login batch-logon failed-logon file-delete file-write local-logon member-added member-removed process-created process-network process-network-failed remote-access remote-logon security-alert service-logon	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling TA0002 - TA0002	15 Rules 1 Models
Exchange	app-activity app-activity-failed app-login dlp-alert dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed failed-app-login	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010	29 Rules 18 Models
IIS	web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models
Office 365	account-password-change app-activity app-activity-failed app-login dlp-alert dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed failed-app-login file-delete file-download file-permission-change file-read file-upload file-write process-created security-alert usb-write	T1003 - OS Credential Dumping T1020 - Automated Exfiltration T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling TA0002 - TA0002 TA0010 - TA0010	44 Rules 19 Models
Routing and Remote Access Service	authentication-successful vpn-login vpn-logout	T1133 - External Remote Services TA0010 - TA0010	4 Rules 4 Models
Sysmon	dns-query file-delete file-write image-loaded process-alert process-created process-network registry-write	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling TA0002 - TA0002	15 Rules 1 Models
Web Application Proxy	remote-logon web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models
Web Application Proxy-TLS Gateway	web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models
Windows	account-creation account-deleted account-disabled account-enabled account-lockout account-password-change account-password-change-failed account-password-reset account-switch account-unlocked app-login audit-log-clear audit-policy-change authentication-failed authentication-successful batch-logon computer-logon config-change dcom-activation-failed dns-query dns-response ds-access failed-app-login failed-logon failed-vpn-login file-close file-delete file-read file-write kerberos-logon local-logon logout-remote member-added member-removed nac-failed-logon nac-logon network-connection-successful ntlm-logon privileged-access privileged-object-access process-created process-network process-network-failed registry-write remote-access remote-logon security-alert service-created service-logon share-access share-access-denied task-created usb-activity usb-insert vpn-login vpn-logout winsession-disconnect workstation-locked workstation-unlocked	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1133 - External Remote Services T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling TA0002 - TA0002 TA0010 - TA0010	19 Rules 5 Models
Windows Defender	dlp-alert security-alert	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010	29 Rules 18 Models

Vendor: Mimecast

Product	Event Types	MITRE ATT&CK® TTP	Content
Targeted Threat Protection - URL	web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models

Vendor: Mvision

Product	Event Types	MITRE ATT&CK® TTP	Content
Mvision	dlp-alert	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010	29 Rules 18 Models

Vendor: NCP

Product	Event Types	MITRE ATT&CK® TTP	Content
NCP	authentication-failed vpn-login vpn-logout	T1133 - External Remote Services TA0010 - TA0010	4 Rules 4 Models

Vendor: Nasuni

Product	Event Types	MITRE ATT&CK® TTP	Content
Nasuni	file-delete file-permission-change file-write	TA0002 - TA0002	2 Rules 1 Models

Vendor: NetApp

Product	Event Types	MITRE ATT&CK® TTP	Content
NetApp	file-alert file-delete file-read file-write	TA0002 - TA0002	2 Rules 1 Models

Vendor: NetDocs

Product	Event Types	MITRE ATT&CK® TTP	Content
NetDocs	app-activity file-delete file-read file-upload file-write	TA0002 - TA0002	2 Rules 1 Models

Vendor: NetMotion Wireless

Product	Event Types	MITRE ATT&CK® TTP	Content
NetMotion Wireless	vpn-login vpn-logout	T1133 - External Remote Services TA0010 - TA0010	4 Rules 4 Models

Vendor: Netskope

Product	Event Types	MITRE ATT&CK® TTP	Content
Security Cloud	app-activity app-login dlp-alert dlp-email-alert-out failed-app-login file-delete file-download file-permission-change file-read file-upload file-write network-connection-failed network-connection-successful security-alert web-activity-allowed web-activity-denied	T1020 - Automated Exfiltration T1041 - Exfiltration Over C2 Channel T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms TA0002 - TA0002 TA0010 - TA0010	39 Rules 21 Models

Vendor: Netwrix

Product	Event Types	MITRE ATT&CK® TTP	Content
Netwrix Auditor	account-disabled account-lockout account-password-reset account-unlocked app-activity app-login database-access database-failed-login ds-access failed-app-login failed-logon file-delete file-write member-added member-removed	TA0002 - TA0002	2 Rules 1 Models

Vendor: Nortel Contivity

Product	Event Types	MITRE ATT&CK® TTP	Content
Nortel Contivity VPN	vpn-login vpn-logout	T1133 - External Remote Services TA0010 - TA0010	4 Rules 4 Models

Vendor: Nutanix

Product	Event Types	MITRE ATT&CK® TTP	Content
Nutanix Files	file-delete file-read file-write	TA0002 - TA0002	2 Rules 1 Models

Vendor: ObserveIT

Product	Event Types	MITRE ATT&CK® TTP	Content
ObserveIT	app-activity app-login database-access dlp-alert failed-app-login process-created remote-logon security-alert	T1003 - OS Credential Dumping T1020 - Automated Exfiltration T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling TA0010 - TA0010	42 Rules 18 Models

Vendor: Oracle

Product	Event Types	MITRE ATT&CK® TTP	Content
Public Cloud	netflow-connection	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1071.002 - Application Layer Protocol: File Transfer Protocols	1 Rules
Solaris	process-created process-created-failed	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling	13 Rules

Vendor: Palo Alto Networks

Product	Event Types	MITRE ATT&CK® TTP	Content
GlobalProtect	app-activity authentication-failed authentication-successful config-change failed-logon failed-vpn-login remote-logon vpn-login vpn-logout	T1133 - External Remote Services TA0010 - TA0010	4 Rules 4 Models
NGFW	authentication-failed authentication-successful config-change dlp-alert file-alert network-alert network-connection-failed network-connection-successful remote-logon security-alert vpn-login web-activity-allowed web-activity-denied	T1020 - Automated Exfiltration T1041 - Exfiltration Over C2 Channel T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms TA0002 - TA0002 TA0010 - TA0010	39 Rules 21 Models
Palo Alto Aperture	app-activity app-login dlp-alert file-delete file-download file-read file-write security-alert	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0002 - TA0002 TA0010 - TA0010	31 Rules 19 Models
WildFire	file-alert network-alert security-alert	TA0002 - TA0002	2 Rules 1 Models

Vendor: Proofpoint

Product	Event Types	MITRE ATT&CK® TTP	Content
ObserveIT	dlp-alert security-alert	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010	29 Rules 18 Models
Proofpoint CASB	dlp-alert security-alert	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010	29 Rules 18 Models
Proofpoint Enterprise Protection	dlp-alert dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed security-alert	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010	29 Rules 18 Models
Proofpoint TAP	dlp-alert dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010	29 Rules 18 Models

Vendor: QUSH

Product	Event Types	MITRE ATT&CK® TTP	Content
Reveal	dlp-alert file-upload file-write nac-logon print-activity remote-logon usb-insert web-activity-allowed	T1020 - Automated Exfiltration T1041 - Exfiltration Over C2 Channel T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms TA0002 - TA0002 TA0010 - TA0010	38 Rules 21 Models

Vendor: Quest Software

Product	Event Types	MITRE ATT&CK® TTP	Content
Change Auditor	account-lockout account-password-change account-password-change-failed account-unlocked ds-access failed-ds-access failed-logon file-delete file-read file-write local-logon member-added member-removed remote-logon	TA0002 - TA0002	2 Rules 1 Models

Vendor: RSA

Product	Event Types	MITRE ATT&CK® TTP	Content
RSA	netflow-connection	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1071.002 - Application Layer Protocol: File Transfer Protocols	1 Rules
RSA DLP	dlp-alert dlp-email-alert-out	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010	29 Rules 18 Models
SecurID	authentication-failed authentication-successful vpn-logout	T1133 - External Remote Services TA0010 - TA0010	4 Rules 4 Models

Vendor: RangerAudit

Product	Event Types	MITRE ATT&CK® TTP	Content
RangerAudit	app-activity app-login database-activity-failed database-query failed-app-login file-read file-write	TA0002 - TA0002	2 Rules 1 Models

Vendor: SAP

Product	Event Types	MITRE ATT&CK® TTP	Content
SAP	account-creation account-deleted account-lockout account-password-change account-unlocked app-activity app-login authentication-failed authentication-successful failed-app-login file-download file-write gcp-bucket-create gcp-compute-list gcp-function-write gcp-general-activity gcp-instance-screenshot gcp-role-list gcp-serviceaccount-creds-write gcp-storage-list gcp-storageobject-read gcp-storageobject-write remote-logon	TA0002 - TA0002	2 Rules 1 Models

Vendor: SFTP

Product	Event Types	MITRE ATT&CK® TTP	Content
SFTP	app-login failed-app-login file-delete file-download file-read file-upload file-write	TA0002 - TA0002	2 Rules 1 Models

Vendor: SIGSCI

Product	Event Types	MITRE ATT&CK® TTP	Content
SIGSCI	web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models

Vendor: SSL Open VPN

Product	Event Types	MITRE ATT&CK® TTP	Content
SSL Open VPN	app-activity app-activity-failed authentication-failed authentication-successful failed-vpn-login vpn-login vpn-logout	T1133 - External Remote Services TA0010 - TA0010	4 Rules 4 Models

Vendor: Safend

Product	Event Types	MITRE ATT&CK® TTP	Content
Data Protection Suite (DPS)	dlp-alert usb-insert usb-read usb-write	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010	29 Rules 18 Models

Vendor: Sailpoint

Product	Event Types	MITRE ATT&CK® TTP	Content
FAM	file-delete file-permission-change file-read file-write	TA0002 - TA0002	2 Rules 1 Models
SecurityIQ	account-creation account-deleted account-lockout account-password-reset file-delete file-download file-permission-change file-read file-upload file-write member-added member-removed	TA0002 - TA0002	2 Rules 1 Models

Vendor: Sangfor

Product	Event Types	MITRE ATT&CK® TTP	Content
NGAF	network-alert web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models

Vendor: Seclore

Product	Event Types	MITRE ATT&CK® TTP	Content
Seclore	file-permission-change file-read file-write	TA0002 - TA0002	2 Rules 1 Models

Vendor: SecureNet

Product	Event Types	MITRE ATT&CK® TTP	Content
SecureNet	vpn-login vpn-logout	T1133 - External Remote Services TA0010 - TA0010	4 Rules 4 Models

Vendor: SentinelOne

Product	Event Types	MITRE ATT&CK® TTP	Content
Singularity	app-activity dns-query dns-response file-alert file-delete file-read file-write network-alert network-connection-failed network-connection-successful process-alert process-created registry-write security-alert task-created web-activity-allowed	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms T1572 - Protocol Tunneling TA0002 - TA0002	22 Rules 3 Models

Vendor: SkySea

Product	Event Types	MITRE ATT&CK® TTP	Content
ClientView	app-activity app-login dlp-email-alert-out file-delete file-download file-read file-upload file-write print-activity process-created security-alert share-access usb-activity web-activity-allowed web-activity-denied	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms T1572 - Protocol Tunneling TA0002 - TA0002	23 Rules 3 Models

Vendor: Sonicwall

Product	Event Types	MITRE ATT&CK® TTP	Content
Sonicwall	failed-vpn-login network-alert remote-logon vpn-login vpn-logout web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1133 - External Remote Services T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms TA0010 - TA0010	12 Rules 6 Models

Vendor: Sophos

Product	Event Types	MITRE ATT&CK® TTP	Content
Sophos Endpoint Protection	app-activity-failed dlp-alert failed-usb-activity file-alert network-alert network-connection-failed process-alert security-alert usb-insert usb-read usb-write	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0002 - TA0002 TA0010 - TA0010	31 Rules 19 Models
Sophos UTM	web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models
Sophos XG Firewall	app-login failed-vpn-login network-connection-failed network-connection-successful vpn-login vpn-logout web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1133 - External Remote Services T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms TA0010 - TA0010	12 Rules 6 Models

Vendor: Squid

Product	Event Types	MITRE ATT&CK® TTP	Content
Squid	web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models

Vendor: StealthBits

Product	Event Types	MITRE ATT&CK® TTP	Content
StealthIntercept	account-disabled account-enabled authentication-failed authentication-successful ds-access failed-ds-access file-permission-change file-read file-write member-added member-removed	TA0002 - TA0002	2 Rules 1 Models

Vendor: Symantec

Product	Event Types	MITRE ATT&CK® TTP	Content
Symantec Blue Coat ProxySG Appliance	network-connection-failed web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models
Symantec CloudSOC	app-activity app-login dlp-alert failed-app-login file-delete file-download file-upload	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010	29 Rules 18 Models
Symantec DLP	dlp-alert dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed security-alert usb-activity usb-insert usb-read usb-write	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010	29 Rules 18 Models
Symantec EDR	authentication-successful file-alert file-delete file-write process-created remote-logon security-alert	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling TA0002 - TA0002	15 Rules 1 Models
Symantec Fireglass	web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models
Symantec Secure Web Gateway	web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models
Symantec WSS	web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models

Vendor: Tanium

Product	Event Types	MITRE ATT&CK® TTP	Content
Endpoint Platform	authentication-failed authentication-successful dns-response process-created security-alert	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling	13 Rules
Integrity Monitor	file-delete file-permission-change file-write network-connection-failed network-connection-successful process-created	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling TA0002 - TA0002	15 Rules 1 Models

Vendor: Trend Micro

Product	Event Types	MITRE ATT&CK® TTP	Content
InterScan Web Security	web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models
OfficeScan	dlp-alert dlp-email-alert-in dlp-email-alert-out privileged-object-access security-alert usb-write web-activity-allowed	T1020 - Automated Exfiltration T1041 - Exfiltration Over C2 Channel T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms TA0010 - TA0010	36 Rules 20 Models

Vendor: Tripwire Enterprise

Product	Event Types	MITRE ATT&CK® TTP	Content
Tripwire Enterprise	file-alert	TA0002 - TA0002	2 Rules 1 Models

Vendor: Unix

Product	Event Types	MITRE ATT&CK® TTP	Content
Auditbeat	app-activity app-activity-failed authentication-successful process-created process-network process-network-failed	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling	13 Rules
Unix	account-creation account-deleted account-lockout account-password-change account-switch authentication-failed authentication-successful batch-logon computer-logon dlp-email-alert-in dlp-email-alert-in-failed dlp-email-alert-out dlp-email-alert-out-failed failed-logon file-delete file-permission-change file-read file-write kerberos-logon local-logon member-added member-removed process-created process-created-failed remote-access remote-logon security-alert task-created	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling TA0002 - TA0002	15 Rules 1 Models
Unix Auditd	account-creation account-deleted account-password-change account-switch app-activity-failed authentication-failed authentication-successful failed-logon local-logon member-added member-removed process-created process-created-failed remote-logon	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling	13 Rules

Vendor: VMware

Product	Event Types	MITRE ATT&CK® TTP	Content
Carbon Black App Control	app-login file-alert file-download file-write local-logon process-alert process-created security-alert usb-activity usb-insert workstation-locked workstation-unlocked	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling TA0002 - TA0002	15 Rules 1 Models
Carbon Black Cloud Endpoint Standard	app-login authentication-successful failed-app-login file-write network-connection-failed network-connection-successful process-created registry-write security-alert	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling TA0002 - TA0002	15 Rules 1 Models
Carbon Black Cloud Enterprise EDR	authentication-successful file-write network-connection-failed network-connection-successful process-alert process-created registry-write security-alert	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling TA0002 - TA0002	15 Rules 1 Models
Carbon Black EDR	file-alert file-delete file-read file-write network-connection-failed network-connection-successful process-alert process-created process-created-failed process-network security-alert	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling TA0002 - TA0002	15 Rules 1 Models

Vendor: Varonis

Product	Event Types	MITRE ATT&CK® TTP	Content
Data Security Platform	dlp-alert file-delete file-permission-change file-read file-write	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0002 - TA0002 TA0010 - TA0010	31 Rules 19 Models

Vendor: Vectra

Product	Event Types	MITRE ATT&CK® TTP	Content
Cognito Stream	authentication-failed authentication-successful dlp-email-alert-out file-delete file-read file-write ntlm-logon remote-logon web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms TA0002 - TA0002	10 Rules 3 Models

Vendor: Virtru

Product	Event Types	MITRE ATT&CK® TTP	Content
Virtru	dlp-alert	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010	29 Rules 18 Models

Vendor: Vormetric

Product	Event Types	MITRE ATT&CK® TTP	Content
Vormetric	file-alert file-read	TA0002 - TA0002	2 Rules 1 Models

Vendor: Watchguard

Product	Event Types	MITRE ATT&CK® TTP	Content
Watchguard	network-connection-failed network-connection-successful web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models

Vendor: Weblogin

Product	Event Types	MITRE ATT&CK® TTP	Content
Weblogin	web-activity-allowed	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	7 Rules 2 Models

Vendor: Zeek

Product	Event Types	MITRE ATT&CK® TTP	Content
Zeek Network Security Monitor	app-activity authentication-failed authentication-successful computer-logon dlp-email-alert-in dlp-email-alert-out dns-query dns-response failed-logon file-delete file-read file-write kerberos-logon nac-failed-logon nac-logon network-alert network-connection-failed network-connection-successful ntlm-logon remote-access remote-logon share-access web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms TA0002 - TA0002	10 Rules 3 Models

Vendor: Zscaler

Product	Event Types	MITRE ATT&CK® TTP	Content
Zscaler Internet Access	app-login dlp-alert network-connection-failed network-connection-successful web-activity-allowed web-activity-denied	T1020 - Automated Exfiltration T1041 - Exfiltration Over C2 Channel T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms TA0010 - TA0010	37 Rules 20 Models
Zscaler Private Access	vpn-login vpn-logout	T1133 - External Remote Services TA0010 - TA0010	4 Rules 4 Models

Vendor: iBoss

Product	Event Types	MITRE ATT&CK® TTP	Content
Secure Web Gateway	web-activity-allowed web-activity-denied	T1041 - Exfiltration Over C2 Channel T1071.001 - Application Layer Protocol: Web Protocols T1567 - Exfiltration Over Web Service T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms	8 Rules 2 Models

Vendor: iManage

Product	Event Types	MITRE ATT&CK® TTP	Content
iManage	app-activity dlp-alert	T1020 - Automated Exfiltration T1071 - Application Layer Protocol TA0010 - TA0010	29 Rules 18 Models