Skip to content
Documentation

Data Exfiltration

Data Exfiltration reports tools and domains associated with data movement, with enforcement action and event/account/host counts.

Data Exfiltration reports tools and domains associated with data movement, with enforcement action and event/account/host counts.

Data Exfiltration in light mode Data Exfiltration in dark mode

Overview

Section titled “Overview”

The overview shows the last 30 days of exfiltration activity, including event count and an enforcement donut. Tool and root-domain filters narrow the investigation.

Detail fields

Section titled “Detail fields”
Field Meaning
Events Observed activity count
Domains Destination root domains
Accounts Accounts involved
Hosts Endpoints involved
Enforcement Blocked, alerted or no enforcement
OS type Platform
Last event Recency

Exports support CSV and JSON. CSV output protects against spreadsheet formula injection because tool, domain, account and host names are attacker-shapeable endpoint data.

Investigation

Section titled “Investigation”
  1. Filter blocked versus no-enforcement events.
  2. Sort by events and affected accounts/hosts.
  3. Open tool/domain detail.
  4. Determine whether the destination is sanctioned.
  5. Correlate account behavior with UEBA and Events.
  6. If malicious, contain through Active Response or domain policy.
  7. If sanctioned, document the business owner.