2_ds_exabeam_advanced_analytics.md

Use-Case	Activity Types/Parsers	MITRE ATT&CK® TTP	Content
Lateral Movement	authentication-failed ↳exabeam-aa-json-app-notification-queue security-alert ↳exabeam-aa-kv-alert-trigger-success-anomaly ↳exabeam-aa-kv-alert-trigger-exaanalyticsmaster-1 ↳exabeam-aa-kv-rule-trigger-success-anomaly ↳exabeam-aa-kv-rule-trigger-success-anomaly-1 ↳exabeam-aa-kv-alert-trigger-exaanalyticsmaster ↳exabeam-search-kv-alert-trigger-success-alertscount	T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1078 - Valid Accounts T1090.003 - Proxy: Multi-hop Proxy	3 Rules
Malware	security-alert ↳exabeam-aa-kv-alert-trigger-success-anomaly ↳exabeam-aa-kv-alert-trigger-exaanalyticsmaster-1 ↳exabeam-aa-kv-rule-trigger-success-anomaly ↳exabeam-aa-kv-rule-trigger-success-anomaly-1 ↳exabeam-aa-kv-alert-trigger-exaanalyticsmaster ↳exabeam-search-kv-alert-trigger-success-alertscount	TA0002 - TA0002	4 Rules 2 Models
Privileged Activity	security-alert ↳exabeam-aa-kv-alert-trigger-success-anomaly ↳exabeam-aa-kv-alert-trigger-exaanalyticsmaster-1 ↳exabeam-aa-kv-rule-trigger-success-anomaly ↳exabeam-aa-kv-rule-trigger-success-anomaly-1 ↳exabeam-aa-kv-alert-trigger-exaanalyticsmaster ↳exabeam-search-kv-alert-trigger-success-alertscount	T1068 - Exploitation for Privilege Escalation	1 Rules