Panther low experimental python

Box Large Number of Downloads

A user has exceeded the threshold for number of downloads within a single time frame.

View Source

Detection Logic

def rule(event):
    return event.get("event_type") == "DOWNLOAD"


def title(event):
    return (
        f"User [{event.deep_get('created_by', 'login', default='<UNKNOWN_USER>')}] "
        f"exceeded threshold for number of downloads in the configured time frame."
    )

Field Validations

Loading…

Comments (0)

Loading comments...