Atlassian Audit Log Exported
Detects export of the Atlassian audit log. An export hands over the full record of who did what across the tenant, which is reconnaissance of the administrative landscape and, in the wrong hands, a map of which accounts are worth targeting. Rare enough in normal operation that each occurrence can be confirmed individually. Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832). Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector BQL (Bloo Query Language): stream=iam where sourcename='ATLASSIAN' and action='AUDIT_LOG_EXPORTED' | groupby user, sitename, domain
Sigma
