[BOX] Files Downloaded in Excess (50/5Mins)

alert any $HOME_NET any -> $HOME_NET any (msg:"[BOX] Files Downloaded in Excess (50/5Mins)"; program:box-api_data; json_map:"src_ip",".ip_address"; json_map:"username",".created_by.login"; json_content:".event_type","DOWNLOAD"; json_content:!".service_name","CloudAlly"; after:track by_src&by_username, count 50, seconds 300; threshold: type suppress, track by_src&by_username, count 1, seconds 3600; reference:url,https://developer.box.com/guides/events/enterprise-events/for-enterprise/; classtype:suspicious-activity; sid:5015213; rev:2; metadata:created_at 2025_01_14, updated_at 2026_06_16;)