Cisco Meraki Large Outbound Transfer From Branch

Siddhant Mishra@Siddhant

•updated yesterday•0•0•1

Detects a substantial outbound transfer from a Meraki-protected site. Branch locations have predictable, modest traffic profiles, which makes a sustained upload unusually visible against that baseline compared with the same transfer leaving a datacentre. Onboarding: CISCO-MERAKI is ingested via Syslog (Bloo extractor 300). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=firewall where sourcename='CISCO-MERAKI' and action='SESSION_ESTABLISHED' | duration 1h | groupby srcip, dstip, dstport, app, txlen