Trend Micro DDEI Email Threat Detected

Siddhant Mishra@Siddhant

•updated yesterday•0•0•1

Detects a threat identified by Deep Discovery Email Inspector. DDEI detonates attachments and inspects URLs in a sandbox, so its verdicts carry behavioural evidence rather than signature matches — which makes them a strong input for detections that most estates never ingest. Onboarding: TREND-MICRO-DDEI is ingested via Syslog (CEF) (Bloo extractor 265). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=threat where sourcename='TREND-MICRO-DDEI' and action='THREAT_DETECTED' | groupby sender, recipient, threat, threattype, srcip