Trellix DLP Console Authentication From New Source

Siddhant Mishra@Siddhant

•updated yesterday•0•0•9

Detects administrative access to the DLP console from an unfamiliar address. Console access permits policy change, violation review and exception approval — everything needed to make data loss invisible, in one place. Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=authentication where sourcename='TRELLIX-DLP' and action='LOGIN' | groupby user, srcip, authproto