Vector Memory Write (Mem0 Upsert/Insert) Correlated with Email Ingestion Tool Call
This rule detects potential automated data exfiltration or staging behavior by identifying the concurrent execution of email-related processes and vector database memory modification commands (insert/upsert) within a 5-minute window on the same host. This combination may indicate an attacker extracting data from email systems and injecting it into a local vector memory store, likely for subsequent LLM-based analysis or exfiltration.
Cortex XDR
