Product: Cato Cloud
Use-Case: Permission Changes
| Rules | Models | MITRE TTPs | Event Types | Parsers |
|---|---|---|---|---|
| 1 | 1 | 1 | 6 | 6 |
| Event Type | Rules | Models |
|---|---|---|
| vpn-logout | T1098.002 - Account Manipulation: Exchange Email Delegate Permissions ↳ EM-InB-Perm-A: Abnormal number of mailbox permission given by user. |
• EM-InB-Perm: Models the number of mailbox permissions given by this user. |