Bulk Jira Ticket Export Indicative of Mass Data Exfiltration

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•6

This rule detects anomalous, high-volume activity in Jira, such as mass ticket viewing, searching, exporting, or attachment downloading, which is often characteristic of unauthorized data exfiltration or reconnaissance. The detection triggers when an account exceeds thresholds of 200 issue-related actions or 8 attachment downloads within a 7-day period.