ARCOS Database Privileged Login From Unrecognised Source
Detects a privileged database login brokered through Arcon ARCOS from a source address without prior history. ARCOS sits in front of database administrative access, so it observes privileged DB sessions that database-native auditing often misses entirely. The extractor exposes a deliberately narrow field set — user, source address and authentication protocol — so this detection is intentionally simple. Onboarding: ARCOS-DBEVT is ingested via RDBMS Log Shipper (Bloo extractor 225). Integration guide: https://bloo.io/docs/integrations BQL (Bloo Query Language): stream=authentication where sourcename='ARCOS-DBEVT' and action='LOGIN' | groupby user, srcip, authproto
Sigma
