Trellix DLP Data Loss Policy Violation Detected

Siddhant Mishra@Siddhant

•updated yesterday•0•0•1

Detects a data loss prevention violation. DLP telemetry is widely collected and almost never written against as detection content — it is usually treated as a compliance report rather than a security signal, which means repeated violations by one user often go unexamined. The file hash and process are both recorded, so a violation can be pivoted into endpoint telemetry directly. Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=threat where sourcename='TRELLIX-DLP' and action='THREAT_DETECTED' | groupby user, file, hash, process, threat, srcip