Zimbra Authentication Failure Burst
Detects a burst of failed authentications against Zimbra. Internet-facing webmail is among the most consistently attacked surfaces in any estate, and Zimbra deployments frequently sit outside the identity controls applied to the rest of the organisation. Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=authentication where sourcename='ZIMBRA' and action='LOGIN' | duration 15m | groupby srcip, reason | select srcip, reason, distinct_count(user) | having distinct_count_col1 > 10
Sigma
