Browse Rules

GitHub Repository Visibility Change

Detects when an organization repository visibility changes.

AWS S3 Bucket Policy Modified

An S3 Bucket was modified.

Box Shield Detected Anomalous Download Activity

A user's download activity has altered significantly.

CodeBuild Project made Public

An AWS CodeBuild Project was made publicly accessible

AWS Network ACL Restricts Outbound Traffic

This policy validates that Network ACLs have some restrictions on outbound traffic.

AWS Security Group Restricts Outbound Traffic

This policy validates that Security Groups have some restrictions on outbound traffic.

Box event triggered by unknown or external user

An external user has triggered a box enterprise event.

AWS Security Group Tightly Restricts Outbound Traffic

This policy validates that Security Groups have restrictive controls on outbound traffic.

Box Large Number of Downloads

A user has exceeded the threshold for number of downloads within a single time frame.

AWS RDS Instance Public Access

This Policy checks that an RDS Instance is not accessible from the public internet.

Snowflake User Daily Query Volume Spike

Returns instances where a user's cumulative daily query volume is much larger than normal. Could indicate exfiltration attempts.

Slack Private Channel Made Public

Detects when a channel that was previously private is made public

Azure Storage Account Public Network Access Enabled

Detects when an existing Azure storage account's network settings are modified to enable public network access. This could indicate a potential data exfiltration risk or misconfiguration.

AWS RDS Instance Snapshot Public Access

This policy validates that RDS Instance snapshots are not publicly restorable. This would allow anyone to restore an old version of your database and have full access to its contents.

AWS Security Group Restricts Traffic Leaving CDE

This policy validates that there are restrictions on what type of traffic may leave Security Groups that are considered with the scope of the PCI CDE. These restrictions help ensure that cardholder data does not leave the CDE.

Azure VM Disk SAS URI Generated

Detects when a Shared Access Signature (SAS) URI is generated for an Azure VM disk. SAS URIs provide time-limited, unauthenticated access to download disk contents directly from Azure Storage. Adversaries can generate SAS URIs to exfiltrate entire virtual machine disks, including operating systems, applications, and all data. This allows offline analysis to extract credentials, secrets, and sensitive data without detection. This is a critical indicator of data exfiltration and should be investig