Trellix DLP Repeated Violations by Single User

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects one user triggering DLP repeatedly in a short window. A single violation is usually a mistake; a pattern is either someone systematically working around the control or an attacker testing which channels are permitted before using the one that is. Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=threat where sourcename='TRELLIX-DLP' and action in ('THREAT_DETECTED', 'THREAT_BLOCKED') | duration 1h | groupby user, srcip | select user, srcip, count(*) as cnt | having cnt > 10