// Detection

Bulk data egress

A transfer far larger than the baseline for the host, to a destination not previously seen. The shape of exfiltration rather than backup.

CriticalInvestigating2alerts raisedSignature

Armed

What this rule does

Rendered from the stored logic, so it cannot drift from what executes.

Any event where eventType is DATA_EGRESS

{
  "kind": "match",
  "where": [
    {
      "op": "eq",
      "field": "eventType",
      "value": "DATA_EGRESS"
    }
  ]
}

Backtest before saving. Alerts already raised keep their original descriptions: they record what the rule found at the time.

NameSeverity

Description

CategoryATT&CK tacticTechnique

Logic

Fields: eventType, username, sourceIp, destinationIp, hostname, processName, commandLine, parentProcess, action, status, country, city

What this rule has actually caught.

Alert	Finding	Status	Risk	Raised
ALT-9A3E1E	Inbound connection negotiated TLS 1.0. Retained as compliance evidence; not indicative of compromise.	False positive	12	8d ago
ALT-70BAD5	Sustained egress to 104.28.211.19, an address with no traffic in the previous thirty days.	Resolved	55	9d ago