Zimbra Threat Detected in Mail Flow

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects a threat identified in Zimbra mail flow. Because Zimbra is both the mail server and the webmail client, a threat here reaches the user directly without passing any separate gateway — in many Zimbra deployments there is no other mail security layer at all. Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=threat where sourcename='ZIMBRA' and action='THREAT_DETECTED' | groupby sender, recipient, threat, srcip, dstip