NTA RADIUS Authentication Anomaly on the Wire
Detects RADIUS authentication activity observed in network traffic, including the MAC address of the requesting device. Seeing RADIUS on the wire catches authentication against network infrastructure that often logs nowhere else — switches, wireless controllers and VPN concentrators. Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717). Integration guide: https://bloo.io/docs/integrations BQL (Bloo Query Language): stream=nta-authentication-radius where sourcename='NTA' | duration 1h | groupby srcip, dstip, user, macaddress
Sigma
