Confluence REST API Bulk Space Content Download

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects a high volume of HTTP requests to the Confluence REST API endpoint '/rest/api/content'. This pattern of access could indicate an attempt to bulk download content from Confluence spaces, potentially for data exfiltration or reconnaissance purposes. The threshold is set to trigger if 30 such requests are observed from a single source IP within a 60-second window.