[BOX] Files Copied in Excess (100/5Mins)

alert any $HOME_NET any -> $HOME_NET any (msg:"[BOX] Files Copied in Excess (100/5Mins)"; program:box-api_data; json_map:"src_ip",".ip_address"; json_map:"username",".created_by.login"; json_content:".event_type","COPY"; after:track by_src&by_username, count 100, seconds 300; threshold: type suppress, track by_src&by_username, count 1, seconds 3600; reference:url,https://developer.box.com/guides/events/enterprise-events/for-enterprise/; classtype:suspicious-activity; sid:5015211; rev:2; metadata:created_at 2025_01_14, updated_at 2026_06_16;)