Zendesk Agent Role Escalated
Detects a role change in Zendesk. An administrator can read every ticket, export data, alter automations and add agents — and support platforms are a favoured target for social engineering precisely because agents are trained to be helpful to strangers. Onboarding: ZENDESK is ingested via NXLog (Bloo extractor 831). Integration guide: https://bloo.io/docs/hypercloud/zendesk-connector BQL (Bloo Query Language): stream=iam where sourcename='ZENDESK' and action='USER_UPDATED' | groupby user, targetuser, role
Sigma
