Features in Guard that may addressed known tactics for exploit?

[kc]

Taking reference from Mitre Enterprise, curious to know, what are the features in Guard that relates or touches on the list of product offerings by Atlassian, following examples ( of tactics used by adversaries?

1)Data from Information Repositories: Confluence

https://attack.mitre.org/techniques/T1213/001/

2)Taint Shared Content

https://attack.mitre.org/techniques/T1080/

3)Transfer Data to Cloud Account

https://attack.mitre.org/techniques/T1537/

4)Event Triggered Execution

https://attack.mitre.org/techniques/T1546/

5)Steal Application Access Token

https://attack.mitre.org/techniques/T1528/

Thank you.

[Jeremy Galloway · Accepted solution]

Thanks for the question kc.

Guard has multiple detections relating to content exfiltration as well as post-exploitation, lateral movement and privileged token use. The audit log provides comprehensive and immutable records about token creation and use, as well as data exports (users, actions, IP/location, etc). In the future, we hope to offer even more complete detections and telemetry around attachment operations to give customers highly detailed insights into these granular actions. We're also pursuing opportunities to create both detections and responses related to our automation platform. 

We're always curious and eager to hear about specific detection requests that can help our customers solve problems in their organizations. If you have any detections ideas, please feel free to share them with us.

[kc]

Thanks @Jeremy Galloway for the response. Am trying to piece out the different features of Guard together to address the above list. Wondering if there's any cheat sheets or sort that explains the objectives of the Guard Features and what it is trying to address?  

Detection ideas if i may share and the example below from Palo Alto SSPM solution to detect posture risks in the Atlassian instance or misconfigurations. 

Concerns and considerations are, the tool requires an api token, generated by an Atlassian Org Admin. If only Guard offer this capability natively it will be great.

https://docs.paloaltonetworks.com/saas-security/saas-security-admin/saas-security-sspm/onboard-saas-apps-supported-by-sspm/onboard-an-atlassian-app-to-sspm