Trend Micro DDEI Inspection Configuration Changed
Detects configuration changes on the email inspector. Weakening sandbox analysis — reducing detonation scope, excluding file types, disabling URL inspection — opens a delivery path for everyone the gateway protects, and the change itself is the only evidence until something gets through. Onboarding: TREND-MICRO-DDEI is ingested via Syslog (CEF) (Bloo extractor 265). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=configuration where sourcename='TREND-MICRO-DDEI' and action='CONFIGURATION_CHANGED' | groupby user, config
Sigma
