GCP BigQuery Results Downloaded From Multiple Tables

Google SecOps@GoogleSecOps

•updated Jan 30, 2025•0•60

This rule detects when a single user downloads results from multiple BigQuery tables within a one-hour window. This behavior can be indicative of data exfiltration attempts, where an attacker or insider is trying to extract a large amount of data from an organization's data warehouse.