NTA Unusually Long-Lived Connection
Detects connections held open far longer than normal. Interactive command and control, tunnelling and remote access tooling all maintain long sessions, whereas ordinary application traffic is short-lived and bursty. Duration is available directly in the connection record, which makes this far cheaper to evaluate than reconstructing sessions from flow data. Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717). Integration guide: https://bloo.io/docs/integrations BQL (Bloo Query Language): stream=nta-connection where sourcename='NTA' and action='CONNECTION_ESTABLISHED' | duration 24h | groupby srcip, dstip, dstport, app, duration
Sigma
