GoAnywhere MFT Configuration Changed

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects configuration changes on the MFT platform. Configuration governs who may transfer what, to where, and whether it is logged — so a change can open an exfiltration path or silence the record of one, and it persists until somebody reviews the configuration again. Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=configuration where sourcename='GOANYWHERE-MFT' and action='CONFIGURATION_CHANGED' | groupby user, config