Trellix DLP Policy Configuration Changed
Detects configuration changes to DLP policy. Weakening the policy — excluding a channel, removing a classification, allowing a destination — opens an exfiltration route for everyone it covers, and unlike most controls, DLP changes rarely trigger any operational complaint to reveal them. Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=configuration where sourcename='TRELLIX-DLP' and action='CONFIGURATION_CHANGED' | groupby user
Sigma
