| Use-Case | Activity Type (Legacy Event Type)/Parsers | MITRE ATT&CK® TTP | Content |
|---|---|---|---|
| Data Leak | scheduled_task-trigger:success (app-activity) ↳imanage-i-kv-app-activity-success-appactivity ↳imanage-i-kv-app-activity-success-accesspermitted ↳imanage-i-json-app-activity-success-checkout alert-trigger:success (dlp-alert) ↳imanage-i-kv-alert-trigger-success-docnum |
T1020 - Automated Exfiltration T1071 - Application Layer Protocol T1114 - Email Collection T1114.003 - Email Collection: Email Forwarding Rule TA0010 - TA0010 |
|