Cisco Meraki Threat Detected at Branch
Detects a threat identified by Cisco Meraki. Meraki is the security stack for branch offices, retail sites and small locations that have no local IT presence — the parts of an estate least likely to be monitored and most likely to be the way in. Onboarding: CISCO-MERAKI is ingested via Syslog (Bloo extractor 300). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=threat where sourcename='CISCO-MERAKI' and action='THREAT_DETECTED' | groupby srcip, dstip, threat, user
Sigma
