Versa Networks Large Outbound Transfer From Branch
Detects a large outbound transfer measured at the Versa edge. Branch sites typically send modest volumes, so a sustained upload from one is either a backup nobody documented or data leaving a location with the least security coverage in the estate. Onboarding: VERSA-NETWORKS is ingested via Syslog (KV) (Bloo extractor 806). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=firewall where sourcename='VERSA-NETWORKS' and action='SESSION_ESTABLISHED' | duration 1h | groupby srcip, dstip, dstport, app, txlen
Sigma
