Rules by Product and UseCase Vendor: oVirt Product: oVirt Use-Case: Malware Rules Models MITRE ATT&CK® TTPs Activity Types Parsers 1 0 1 1 1 Event Type Rules Models app-login T1078 - Valid Accounts ↳ Auth-Blacklist-Shost: User authentication or login from a known blacklisted IP