Trellix ePO Notification Email Routing Change
Detects notification mail sent by ePO, including its recipients. Redirecting or suppressing ePO notifications means endpoint security alerts stop reaching the team that would act on them — the alerts still fire, nobody reads them. Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857). Integration guide: https://bloo.io/docs/integrations BQL (Bloo Query Language): stream=email-gateway where sourcename='TRELLIX-EPO' and action='EMAIL_SENT' | groupby sender, recipient, direction, remoteip
Sigma
