Confluence Wiki Bulk Page Export Detected

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects a high volume of HTTP requests to a Confluence Wiki instance that include both '/wiki/' and 'export' in the URI. Specifically, it triggers if 10 such requests are observed from the same source IP within a 60-second window. This behavior could indicate an attempt to bulk export pages from a Confluence Wiki, potentially for data exfiltration.