Cloud Data Exfiltration

This trigger is responsible for handling cloud data exfiltration alerts

Cloud Incident Response

Details

ID3138b81e2f9359a688026162234eb419
Runs PlaybookCloud Data Exfiltration Response
Suggestion ReasonRecommended for alerts involving cloud data exfiltration

Alert conditions (all must match)

Field Operator Value
alert_name CONTAINS An identity performed a suspicious download of multiple cloud storage object

Source

Trigger_-_Cloud_Data_Exfiltration_Response.json
Download History Raw 
{
  "trigger_id": "3138b81e2f9359a688026162234eb419",
  "playbook_id": "Cloud Data Exfiltration Response",
  "suggestion_reason": "Recommended for alerts involving cloud data exfiltration",
  "description": "This trigger is responsible for handling cloud data exfiltration alerts",
  "trigger_name": "Cloud Data Exfiltration",
  "alerts_filter": {
    "filter": {
      "AND": [
        {
          "SEARCH_FIELD": "alert_name",
          "SEARCH_TYPE": "CONTAINS",
          "SEARCH_VALUE": "An identity performed a suspicious download of multiple cloud storage object"
        }
      ]
    }
  },
  "supportedModules": [
    "xsiam"
  ]
}