Trellix DLP Transfer Allowed After Blocks
Detects permitted transfers from a user who was recently blocked. Repeated blocks followed by a success means a channel was found that the policy does not cover — the user, or the attacker operating as them, worked out what gets through. Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=firewall where sourcename='TRELLIX-DLP' and action='PACKET_ALLOWED' | duration 1h | groupby srcip, dstip, dstport, app
Sigma
