Atlassian Privilege Changed for User
Detects a privilege change within an Atlassian site. Confluence and Jira hold architecture documentation, runbooks, credentials pasted into tickets and project plans — so a privilege escalation here is a documentation-estate compromise, which typically precedes a far more targeted attack elsewhere. Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832). Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector BQL (Bloo Query Language): stream=iam where sourcename='ATLASSIAN' and action='PRIVILEGE_CHANGED' | groupby user, targetuser, role, group, sitename
Sigma
