Trellix ePO Endpoint Policy Updated

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects policy changes in Trellix ePolicy Orchestrator. ePO governs endpoint protection across the estate, so weakening a policy there disables defences on many machines at once — far more efficient for an attacker than tampering with hosts individually, and visible only in ePO's own audit trail. Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857). Integration guide: https://bloo.io/docs/integrations BQL (Bloo Query Language): stream=iam where sourcename='TRELLIX-EPO' and action='POLICY_UPDATED' | groupby user, targetuser, role