Versa Networks Repeated URL Blocks From Single Source

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects one internal source repeatedly blocked from reaching URLs. Persistent attempts after a block indicate automated software rather than a person — a person gives up, malware retries on a timer. Onboarding: VERSA-NETWORKS is ingested via Syslog (KV) (Bloo extractor 806). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=webfilter where sourcename='VERSA-NETWORKS' and action='URL_BLOCKED' | duration 1h | groupby srcip, user | select srcip, user, count(*) as cnt | having cnt > 20