Internal Information Repository Bulk Data Access

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects bulk data access from an internal information repository. It triggers when a single source IP address performs 50 or more HTTP GET requests within a 30-second window to any destination. This behavior could indicate an attempt to exfiltrate or rapidly collect large amounts of data from internal web-based resources.