Aegis
Triage queue
// Operations

Bulk document read on the Finance share

hlindqvist read 1,284 documents in nine minutes against a baseline of fourteen per day.

ALT-655369MediumResolved
52Moderate

This alert has been escalated. Open the incident to see the full case.

Why this fired

Rule: Mass file access

20+ events where eventType is one of FILE_READ, ANOMALOUS_FILE_ACCESS, grouped by username, within 10 minutes

One principal reading far more files in a short window than normal use produces, consistent with staging data for collection.

Triggering event

The exact record that satisfied the rule.

Full event
Anomalous File AccessMedium2026-09-03 13:23:29ZWIN-FS02
Principal hlindqvist read 1,284 documents from \\WIN-FS02\Finance in 9 minutes (baseline: 14/day)

What else was happening

Other activity for hlindqvist in the surrounding hour.

TimeEventSeverityHost
2026-09-03 13:15:29ZFile ReadInfoWIN-FS02
2026-09-03 13:15:38ZFile ReadInfoWIN-FS02
2026-09-03 13:15:47ZFile ReadInfoWIN-FS02
2026-09-03 13:15:56ZFile ReadInfoWIN-FS02
2026-09-03 13:16:05ZFile ReadInfoWIN-FS02
2026-09-03 13:16:14ZFile ReadInfoWIN-FS02
2026-09-03 13:16:23ZFile ReadInfoWIN-FS02
2026-09-03 13:16:32ZFile ReadInfoWIN-FS02
2026-09-03 13:16:41ZFile ReadInfoWIN-FS02
2026-09-03 13:16:50ZFile ReadInfoWIN-FS02
2026-09-03 13:16:59ZFile ReadInfoWIN-FS02
2026-09-03 13:17:08ZFile ReadInfoWIN-FS02
2026-09-03 13:17:17ZFile ReadInfoWIN-FS02
2026-09-03 13:17:26ZFile ReadInfoWIN-FS02
2026-09-03 13:17:35ZFile ReadInfoWIN-FS02
2026-09-03 13:17:44ZFile ReadInfoWIN-FS02
2026-09-03 13:17:53ZFile ReadInfoWIN-FS02
2026-09-03 13:18:02ZFile ReadInfoWIN-FS02
2026-09-03 13:18:11ZFile ReadInfoWIN-FS02
2026-09-03 13:18:20ZFile ReadInfoWIN-FS02

Alert

Raised
9d ago
Last updated
7d ago
Risk score
52
Source
WIN-FS02
Detected by
Correlation rule

Entity risk

22Guarded

hlindqvist carries a standing risk score derived from all of its activity, not just this alert.

Open the entity profile

Pivot