Siddhant Mishra
@SiddhantMumbaiCompletionist
0 followers0 downloads36 copies0 likes234 views
159 detections
Filters
Last updated
All Time
Detection languages
159
Categories
32
17
16
13
12
Platforms
34
29
25
16
1
Products / Services
26
8
5
5
5
MITRE Techniques
44
34
33
23
21
Detects a substantial outbound transfer from a Meraki-protected site. Branch
locations have predictable, modest traffic profiles, which makes a sustained upload
unusually visible against that baseline compared with the same transfer leaving a
datacentre.
Onboarding: CISCO-MERAKI is ingested via Syslog (Bloo extractor 300).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='CISCO-MERAKI' and action='SESSION_ESTABLISHED'
| duration 1h
| groupby srcip, dstip, dstport, app, txlen
locations have predictable, modest traffic profiles, which makes a sustained upload
unusually visible against that baseline compared with the same transfer leaving a
datacentre.
Onboarding: CISCO-MERAKI is ingested via Syslog (Bloo extractor 300).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=firewall where sourcename='CISCO-MERAKI' and action='SESSION_ESTABLISHED'
| duration 1h
| groupby srcip, dstip, dstport, app, txlen
Detects configuration changes on F5 BIG-IP. Changing a virtual server, pool or
iRule can silently redirect application traffic to infrastructure the attacker
controls — users reach the same hostname and notice nothing, while traffic takes a
different path.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='F5BIGIP'
and action='CONFIGURATION_CHANGED'
| groupby user
iRule can silently redirect application traffic to infrastructure the attacker
controls — users reach the same hostname and notice nothing, while traffic takes a
different path.
Onboarding: F5BIGIP is ingested via Syslog (Bloo extractor 81).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='F5BIGIP'
and action='CONFIGURATION_CHANGED'
| groupby user
Detects an attack identified by the FortiWeb web application firewall. WAF telemetry
is widely collected and almost never turned into detection content — it is usually
left as a vendor dashboard, so repeated targeting of one application by one source
goes unexamined.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='FORTIWEB' and action='THREAT_DETECTED'
| duration 1h
| groupby srcip, dstip, threat
| select srcip, dstip, threat, count(*) as cnt
| having cnt > 10
is widely collected and almost never turned into detection content — it is usually
left as a vendor dashboard, so repeated targeting of one application by one source
goes unexamined.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='FORTIWEB' and action='THREAT_DETECTED'
| duration 1h
| groupby srcip, dstip, threat
| select srcip, dstip, threat, count(*) as cnt
| having cnt > 10
Detects configuration changes on the FortiWeb WAF. Disabling a signature, adding an
exclusion or switching a policy to monitor-only removes protection from the
application behind it — and because the application keeps working normally, nothing
else signals that the control has gone.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='FORTIWEB'
and action='CONFIGURATION_CHANGED'
| groupby user, config
exclusion or switching a policy to monitor-only removes protection from the
application behind it — and because the application keeps working normally, nothing
else signals that the control has gone.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='FORTIWEB'
and action='CONFIGURATION_CHANGED'
| groupby user, config
Detects authentication to the MFT platform where multi-factor was not initiated.
The extractor records MFA_INITIATED separately from LOGIN, so a login with no
corresponding MFA event indicates either an account exempt from the policy or a
path around it — on an internet-facing transfer platform, both matter.
Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='GOANYWHERE-MFT' and action='LOGIN'
| groupby user, srcip, authproto
The extractor records MFA_INITIATED separately from LOGIN, so a login with no
corresponding MFA event indicates either an account exempt from the policy or a
path around it — on an internet-facing transfer platform, both matter.
Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='GOANYWHERE-MFT' and action='LOGIN'
| groupby user, srcip, authproto
Detects administrative login to the FortiWeb console from an address without prior
history. Console access permits policy change and signature control, so compromise
of the WAF administrator is equivalent to removing the WAF for every application
behind it.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='FORTIWEB' and action='LOGIN'
| groupby user, srcip
history. Console access permits policy change and signature control, so compromise
of the WAF administrator is equivalent to removing the WAF for every application
behind it.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='FORTIWEB' and action='LOGIN'
| groupby user, srcip
Detects OAuth credential activity on GitHub. Tokens bypass password and multi-factor
controls and persist until revoked, making them the standard persistence mechanism
on the platform. A token created on a compromised account continues to work long
after the password is reset.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=iam where sourcename='GITHUB' and action='CONFIGURATION_CHANGED'
| groupby target, role, accesstype, operationtype, authtokenhash
controls and persist until revoked, making them the standard persistence mechanism
on the platform. A token created on a compromised account continues to work long
after the password is reset.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=iam where sourcename='GITHUB' and action='CONFIGURATION_CHANGED'
| groupby target, role, accesstype, operationtype, authtokenhash
Detects repeated blocked access requests through Zscaler Private Access. ZPA brokers
access to internal applications without exposing the network, so a user repeatedly
blocked is probing for applications they are not entitled to reach — the zero trust
equivalent of internal port scanning.
Onboarding: ZSCALER-SPA is ingested via the Zscaler connector (Bloo extractor 176).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=zpa-connector where sourcename='ZSCALER-SPA' and action='REQUEST_BLOCKED'
| duration 1h
| groupby user, srcip
| select user, srcip, distinct_count(app)
| having distinct_count_col1 > 5
access to internal applications without exposing the network, so a user repeatedly
blocked is probing for applications they are not entitled to reach — the zero trust
equivalent of internal port scanning.
Onboarding: ZSCALER-SPA is ingested via the Zscaler connector (Bloo extractor 176).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=zpa-connector where sourcename='ZSCALER-SPA' and action='REQUEST_BLOCKED'
| duration 1h
| groupby user, srcip
| select user, srcip, distinct_count(app)
| having distinct_count_col1 > 5
Detects repository creation or addition to an organisation. Attackers use new
repositories as staging ground for exfiltrated data, as hosting for second-stage
payloads under a trusted domain, or as a place to park stolen source.
Pair with the creating identity: a repository created by an account that has never
created one before is the interesting case.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=github where sourcename='GITHUB'
and action in ('REPOSITORY_CREATED', 'REPOSITORY_ADDED')
| groupby target, repositoryid, newrepositoryadded, organisationid
repositories as staging ground for exfiltrated data, as hosting for second-stage
payloads under a trusted domain, or as a place to park stolen source.
Pair with the creating identity: a repository created by an account that has never
created one before is the interesting case.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=github where sourcename='GITHUB'
and action in ('REPOSITORY_CREATED', 'REPOSITORY_ADDED')
| groupby target, repositoryid, newrepositoryadded, organisationid
Detects connections held open far longer than normal. Interactive command and
control, tunnelling and remote access tooling all maintain long sessions, whereas
ordinary application traffic is short-lived and bursty.
Duration is available directly in the connection record, which makes this far
cheaper to evaluate than reconstructing sessions from flow data.
Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=nta-connection where sourcename='NTA'
and action='CONNECTION_ESTABLISHED'
| duration 24h
| groupby srcip, dstip, dstport, app, duration
control, tunnelling and remote access tooling all maintain long sessions, whereas
ordinary application traffic is short-lived and bursty.
Duration is available directly in the connection record, which makes this far
cheaper to evaluate than reconstructing sessions from flow data.
Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=nta-connection where sourcename='NTA'
and action='CONNECTION_ESTABLISHED'
| duration 24h
| groupby srcip, dstip, dstport, app, duration
Page 2 of 16