EVENT
File Download to Local Device.
RECOMMENDED ACTION
The User has downloaded a file to a local device. If this is occurring very frequently by the same user it could indicate data exfiltration from the organization. You should consider discussing this with your Customer.
* For security reasons, the file path shown in SaaS Alerts is not included when exporting data from the Analyze Module.
ALERT TYPE
Logged Event
Comments
1 comment
The fact the path is not shown makes it very hard to understand what is being shared. There is no way to see a list of file and path. You have to click onto each one. Very hard to undertand what happenned exactly while you are investigating. We then need to make an audit in microsoft. Pretty uneffiscient process. Are there no way to use saas-alert to get a list of file and path ?
Please sign in to leave a comment.