Azure Activity Export/Download Spike

Ankit Mehta@Secvyn

•updated Jun 30, 2026•3•0•5

This rule detects an unusual spike in 'Export' or 'Download' operations within Azure Activity logs by a single caller. It triggers when a user performs 5 or more such operations within an hour, which could indicate data exfiltration attempts or suspicious data access patterns.