Cisco Wireless LAN Controller Account Added

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects account creation on the wireless controller. Network infrastructure accounts are frequently local to the device, outside central identity management and never reviewed — which makes one created by an attacker an exceptionally durable way back into the network. Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=iam where sourcename='CISCO-AIR-CT5508-K9' and action='USER_ADDED' | groupby user, targetuser, role