O365_SharePoint_FileAccessed_Multiple

ID: 100486

Description:

An aggregation rule to track Sharepoint FilePreviewed OR FileDownloaded OR FileAccessed events in Office365 Audit logs.

This rule will trigger when the number of events per one (1) hour exceeds 100. This indicates that a particular user may be quickly viewing/downloading larger number of files than would be expected. Possible false positives occur when sync/backup operations occur, or when a particular user normally handles larger number of files in Office365.

Notes: Corresponding rule O365_SharePoint_FileAccessed tracks suspicious single events related to Office365 file access

Repository: Fluency Group: Office365 Type: event

Default Status:

Enabled

Selector:

Query:

Filters:

Behavior Rule:

Risks:

Attributes:

Correlation Rules:

Aggregation:

History:

This page was automatically created/formatted on Wed, 2022 May 4 21:43:53 EDT, from rule_dump.json (4d88bffdfb1cea26b3985f2193033606)