Versa Networks Blocked Packet Pattern Indicating Scanning

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects a source generating blocked packets across many destination ports. Branch edge firewalls see lateral scanning between sites that a central firewall never observes, because that traffic does not traverse the core. Onboarding: VERSA-NETWORKS is ingested via Syslog (KV) (Bloo extractor 806). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=firewall where sourcename='VERSA-NETWORKS' and action='PACKET_BLOCKED' | duration 10m | groupby srcip | select srcip, distinct_count(dstport) | having distinct_count_col1 > 25