Cisco Wireless LAN Controller Threat Detected
Detects a threat raised by the Cisco wireless LAN controller — rogue access points, containment events and wireless intrusion signatures. Wireless is a physical-access attack surface that endpoint and network monitoring never observes, and the controller is the only thing that sees it. A rogue access point broadcasting the corporate SSID collects credentials from devices that connect automatically. Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=threat where sourcename='CISCO-AIR-CT5508-K9' and action='THREAT_DETECTED' | groupby srcip, dstip, threat, user
Sigma
