Whisper Security - BGP Route Anomaly with Traffic Spike

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

Detects BGP origin AS changes for IP prefixes correlated with network traffic volume spikes. May indicate BGP hijacking or adversary-in-the-middle attacks.

Attribute	Value
Type	Analytic Rule
Solution	Whisper
ID	1c08a7cb-7ff4-5a37-a961-39c29f8d07bd
Severity	High
Status	Available
Kind	Scheduled
Tactics	Collection
Techniques	T1557
Required Connectors	WhisperSecurityConnector
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
CommonSecurityLog	✓	✓	✓
WhisperHistory_CL	?	✓	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Analytic Rules · Back to Whisper