Cisco Wireless LAN Controller Account Removed

Siddhant Mishra@Siddhant

•updated yesterday•0•0•2

Detects account deletion on the wireless controller. Removing administrators denies the network team control of the wireless estate, and on infrastructure that often has only a handful of accounts, losing one can mean losing management access entirely. Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=iam where sourcename='CISCO-AIR-CT5508-K9' and action='USER_DELETED' | groupby user, targetuser, role