Use Case: Insider Threat
Mass download and bulk export
An analyst downloaded 22,000 files from the engineering SharePoint in 90 minutes at 11 PM. Their normal daily download is 40 files. ManySignal flagged the behavioral deviation within the first 10 minutes.
The 90-minute data collection before the departure
Mass download events are one of the clearest behavioral signals for pre-departure data theft or competitive intelligence gathering. Unlike subtle exfiltration (individual file access over weeks), mass downloads are high-volume events concentrated in a short time window — the attacker maximizes their data collection before access is revoked or the activity is noticed. The challenge is distinguishing these events from legitimate bulk operations like data migrations and eDiscovery holds.
rule: mass_download_behavioral
type: behavioral_baseline + dlp
sources:
- microsoft_365_audit (FileDownloaded, FileAccessed)
- google_workspace_drive_audit
- salesforce_event_monitoring
- sharepoint_audit
trigger:
- condition: |
file_download_count(2h) > user_baseline_p95 * 2.5
OR file_download_count(2h) > 1000 # absolute threshold
enrichments:
- data_classification: purview, nightfall, custom_tags
- user_risk_context: departing, pip, insider_risk_score
- itsm_correlation: migration_ticket, ediscovery_hold
- download_destination: local_only vs sync_to_cloud
- time_context: business_hours, weekday_vs_weekend
mitre: T1213 (Data from Information Repositories)MITRE ATT&CK mapping
Mass download FAQ
What download volume triggers a mass download alert?
The threshold is relative to the user's behavioral baseline, not an absolute number. A user who regularly downloads 500 files per day has a different threshold than one who normally downloads 20. ManySignal fires when the download volume exceeds the user's 90-day P95 by more than 2.5x. Absolute thresholds (e.g., >1,000 files in any 2-hour period) apply as a secondary catch for new accounts with insufficient history.
Does this detect bulk export from SaaS applications like Salesforce or HubSpot?
Yes. CRM bulk exports, SharePoint library downloads, Confluence space exports, and GitHub repository archives are all monitored via the respective application audit logs. SaaS bulk export events are enriched with data classification to assess whether the exported data contains customer PII, financial records, or competitive intelligence.
What legitimate use cases trigger false positives?
Common false positives: IT performing a data migration, legal placing a litigation hold (mass download for eDiscovery), and employees onboarding to a new team and downloading reference materials. ManySignal's ITSM integration checks for active migration or eDiscovery tickets when a mass download alert fires, automatically reducing the severity if a matching ticket is found.
Can ManySignal stop a download in progress?
For some DLP-integrated platforms (Microsoft 365, Google Workspace via CASB integration), ManySignal can invoke a block on the download session in progress. This is a high-impact action — blocking a data migration would cause significant disruption — so it's configured as approve-gated by default with a 5-minute analyst review window.
Catch bulk data collection before it becomes an exfiltration
Behavioral baseline DLP with data classification — tuned to each user's normal download patterns.