Atlassian API Token Created
Detects creation of an Atlassian API token. Tokens authenticate without a password and without multi-factor, and they persist until revoked — which makes token creation one of the most durable persistence mechanisms available on a SaaS platform holding an organisation's project and documentation estate. Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832). Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector BQL (Bloo Query Language): stream=iam where sourcename='ATLASSIAN' and action='API_TOKEN_CREATED' | groupby user, targetuser, sitename, domain
Sigma
