Cisco Wireless LAN Controller Authentication Failures
Detects repeated authentication failures against the wireless controller. Wireless authentication attacks require physical proximity, so unlike internet-facing brute force this indicates somebody near the building — which changes the response entirely. Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=authentication where sourcename='CISCO-AIR-CT5508-K9' and action='LOGIN' | duration 15m | groupby srcip, reason | select srcip, reason, distinct_count(user) | having distinct_count_col1 > 5
Sigma
