Trellix ePO Console Authentication From New Source

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects administrative login to the ePO console. An ePO administrator can change protection policy, create exclusions and push software to every managed endpoint — which makes this account one of the highest-value targets in any estate running it. Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857). Integration guide: https://bloo.io/docs/integrations BQL (Bloo Query Language): stream=authentication where sourcename='TRELLIX-EPO' and action='LOGIN' | groupby user, srcip, authproto