Siddhant Mishra
@SiddhantMumbaiCompletionist
0 followers0 downloads35 copies0 likes232 views
159 detections
Filters
Last updated
All Time
Detection languages
159
Categories
32
17
16
13
12
Platforms
34
29
25
16
1
Products / Services
26
8
5
5
5
MITRE Techniques
44
34
33
23
21
Detects administrative access to the DLP console from an unfamiliar address. Console
access permits policy change, violation review and exception approval — everything
needed to make data loss invisible, in one place.
Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='TRELLIX-DLP' and action='LOGIN'
| groupby user, srcip, authproto
access permits policy change, violation review and exception approval — everything
needed to make data loss invisible, in one place.
Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='TRELLIX-DLP' and action='LOGIN'
| groupby user, srcip, authproto
Detects a data loss prevention violation. DLP telemetry is widely collected and
almost never written against as detection content — it is usually treated as a
compliance report rather than a security signal, which means repeated violations by
one user often go unexamined.
The file hash and process are both recorded, so a violation can be pivoted into
endpoint telemetry directly.
Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='TRELLIX-DLP' and action='THREAT_DETECTED'
| groupby user, file, hash, process, threat, srcip
almost never written against as detection content — it is usually treated as a
compliance report rather than a security signal, which means repeated violations by
one user often go unexamined.
The file hash and process are both recorded, so a violation can be pivoted into
endpoint telemetry directly.
Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='TRELLIX-DLP' and action='THREAT_DETECTED'
| groupby user, file, hash, process, threat, srcip
Detects a threat raised by the Cisco wireless LAN controller — rogue access points,
containment events and wireless intrusion signatures. Wireless is a physical-access
attack surface that endpoint and network monitoring never observes, and the
controller is the only thing that sees it.
A rogue access point broadcasting the corporate SSID collects credentials from
devices that connect automatically.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='CISCO-AIR-CT5508-K9' and action='THREAT_DETECTED'
| groupby srcip, dstip, threat, user
containment events and wireless intrusion signatures. Wireless is a physical-access
attack surface that endpoint and network monitoring never observes, and the
controller is the only thing that sees it.
A rogue access point broadcasting the corporate SSID collects credentials from
devices that connect automatically.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='CISCO-AIR-CT5508-K9' and action='THREAT_DETECTED'
| groupby srcip, dstip, threat, user
Detects a burst of denied requests at the load balancer. The appliance sits in front
of the application and sees attempts the application never receives, which makes it
an early warning layer that most estates collect and never query.
Onboarding: BARRACUDA-LOADBALANCER is ingested via Syslog (CEF) (Bloo extractor 859).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webserver where sourcename='BARRACUDA-LOADBALANCER'
and action='REQUEST_DENIED'
| duration 15m
| groupby srcip, useragent
| select srcip, useragent, distinct_count(url)
| having distinct_count_col1 > 20
of the application and sees attempts the application never receives, which makes it
an early warning layer that most estates collect and never query.
Onboarding: BARRACUDA-LOADBALANCER is ingested via Syslog (CEF) (Bloo extractor 859).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webserver where sourcename='BARRACUDA-LOADBALANCER'
and action='REQUEST_DENIED'
| duration 15m
| groupby srcip, useragent
| select srcip, useragent, distinct_count(url)
| having distinct_count_col1 > 20
Detects a threat identified by Cisco Meraki. Meraki is the security stack for branch
offices, retail sites and small locations that have no local IT presence — the parts
of an estate least likely to be monitored and most likely to be the way in.
Onboarding: CISCO-MERAKI is ingested via Syslog (Bloo extractor 300).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='CISCO-MERAKI' and action='THREAT_DETECTED'
| groupby srcip, dstip, threat, user
offices, retail sites and small locations that have no local IT presence — the parts
of an estate least likely to be monitored and most likely to be the way in.
Onboarding: CISCO-MERAKI is ingested via Syslog (Bloo extractor 300).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='CISCO-MERAKI' and action='THREAT_DETECTED'
| groupby srcip, dstip, threat, user
Detects account deletion on the wireless controller. Removing administrators denies
the network team control of the wireless estate, and on infrastructure that often
has only a handful of accounts, losing one can mean losing management access
entirely.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CISCO-AIR-CT5508-K9' and action='USER_DELETED'
| groupby user, targetuser, role
the network team control of the wireless estate, and on infrastructure that often
has only a handful of accounts, losing one can mean losing management access
entirely.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CISCO-AIR-CT5508-K9' and action='USER_DELETED'
| groupby user, targetuser, role
Detects files transferred with a visibility or ownership change on the MFT platform.
Widening who can retrieve a file is the quietest possible exfiltration route: the
data never leaves the platform in a way the network would notice, it simply becomes
reachable by someone new.
Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=documents where sourcename='GOANYWHERE-MFT'
| groupby user, targetuser, file, filetype, visibility, owner
Widening who can retrieve a file is the quietest possible exfiltration route: the
data never leaves the platform in a way the network would notice, it simply becomes
reachable by someone new.
Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=documents where sourcename='GOANYWHERE-MFT'
| groupby user, targetuser, file, filetype, visibility, owner
Detects notification mail sent by ePO, including its recipients. Redirecting or
suppressing ePO notifications means endpoint security alerts stop reaching the team
that would act on them — the alerts still fire, nobody reads them.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=email-gateway where sourcename='TRELLIX-EPO' and action='EMAIL_SENT'
| groupby sender, recipient, direction, remoteip
suppressing ePO notifications means endpoint security alerts stop reaching the team
that would act on them — the alerts still fire, nobody reads them.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=email-gateway where sourcename='TRELLIX-EPO' and action='EMAIL_SENT'
| groupby sender, recipient, direction, remoteip
Detects configuration changes on the Zimbra server. Mail server configuration
controls routing, authentication and logging; a change can create a delivery path,
weaken authentication, or stop the server recording what happens next.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='ZIMBRA' and action='CONFIGURATION_CHANGED'
| groupby user, config
controls routing, authentication and logging; a change can create a delivery path,
weaken authentication, or stop the server recording what happens next.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='ZIMBRA' and action='CONFIGURATION_CHANGED'
| groupby user, config
Detects permitted transfers from a user who was recently blocked. Repeated blocks
followed by a success means a channel was found that the policy does not cover —
the user, or the attacker operating as them, worked out what gets through.
Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='TRELLIX-DLP' and action='PACKET_ALLOWED'
| duration 1h
| groupby srcip, dstip, dstport, app
followed by a success means a channel was found that the policy does not cover —
the user, or the attacker operating as them, worked out what gets through.
Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='TRELLIX-DLP' and action='PACKET_ALLOWED'
| duration 1h
| groupby srcip, dstip, dstport, app
Page 1 of 16