Exfiltration Content Pack

Alarms

Focused on specific file or data events that interact with resources containing sensitive data.

• Exfiltration – Possible Exfiltration

Reports

Useful for providing regular summary data to interested parties.

• Exfiltration – Date Leakage Analysis
• Exfiltration – Insider Threat Analysis

Variables

• FTP_SERVERS

Views

Shows activity that stems from system interaction on the network involving sensitive data locations or user-centric events and zone-specific scenarios.

• Exfiltration – High-Value Host Activity
• Exfiltration – Potential Insider Threat Activity
• Exfiltration – DLP Device Activity
• Exfiltration – Zone Exfiltration Summary

Correlation Rules

Focused on data-related events that interact with the high-value hosts, tracking them and determining which users trigger the rules.

• Exfiltration – Abnormal Communication and Exfiltration from High-Value Host – Events and Flows
• Exfiltration - FTP Traffic with High-Value Host
• Exfiltration – High Number of File Status Events on High-Value Hosts
• Exfiltration - IM Client File Transfers with High-Value Hosts
• Exfiltration - P2P Activity with High-Value Hosts

Watchlists

Keep track of resources on the network that contain a degree of sensitive information or specific users that have interacted with these sensitive resources.

• High Value Hosts
• Exfiltration – Possible User Threats
• Exfiltration – User Whitelist