Zendesk Ticket Data Exported
Detects an export from Zendesk. Support platforms accumulate exactly what an attacker wants for the next stage — customer names, contact details, account references, and the content of conversations in which people routinely paste things they should not. An export takes all of it at once. Onboarding: ZENDESK is ingested via NXLog (Bloo extractor 831). Integration guide: https://bloo.io/docs/hypercloud/zendesk-connector BQL (Bloo Query Language): stream=ticket-requested where sourcename='ZENDESK' and action='EXPORTED' | groupby user, srcip, sourceclassification, sourcelabel
Sigma
