SafeSquid Repeated Blocked Requests From Single Source

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects persistent blocked web requests from one internal source. A person stops after a block; software does not. Sustained retries after blocking indicate automation attempting to reach a destination it has been configured to use. Onboarding: SAFESQUID-SWG is ingested via Syslog (Bloo extractor 812). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=webfilter where sourcename='SAFESQUID-SWG' and action='URL_BLOCKED' | duration 1h | groupby srcip, user, category | select srcip, user, category, count(*) as cnt | having cnt > 25