SafeSquid Secure Web Gateway Policy Bypassed
Detects a web request bypassing SafeSquid filtering policy. The extractor exposes BYPASSED as a distinct action, which is unusual and valuable — most gateways record only allow or block, so a bypass is normally indistinguishable from an allow. A bypass means policy was deliberately not applied to that request, and the question is who arranged that. Onboarding: SAFESQUID-SWG is ingested via Syslog (Bloo extractor 812). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=webfilter where sourcename='SAFESQUID-SWG' and action='BYPASSED' | groupby srcip, user, domain, url, category
Sigma
