Trellix ePO Service State Change
Detects service state changes recorded by ePO. Protection services stopping and restarting across managed endpoints can indicate tampering — and because ePO observes it centrally, the pattern across many hosts is visible in a way it is not from any single machine. Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857). Integration guide: https://bloo.io/docs/integrations BQL (Bloo Query Language): stream=auditd where sourcename='TRELLIX-EPO' and action='SERVICE_STARTED' | duration 1h | groupby user, process, commandline
Sigma
