Atlassian External User Invited to Site
Detects a user being invited into an Atlassian site. Invitation is the lowest-friction route into a documentation estate: no exploit, no credential theft, simply an account added by someone with the rights to do so. Compare the invited domain against the organisation's own; an external domain invitation outside a known partner arrangement warrants confirmation. Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832). Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector BQL (Bloo Query Language): stream=iam where sourcename='ATLASSIAN' and action in ('USER_INVITED', 'USER_REINVITED') | groupby user, targetuser, domain, sitename
Sigma
