Box File Visibility Changed to Public
Detects a Box file or folder being made publicly accessible. Public sharing turns an internal document into an internet-reachable URL, and is both a common accidental data exposure and a deliberate low-friction exfiltration route that generates no outbound traffic from the corporate network. The Visibility field carries the change, which makes this directly detectable rather than inferred. Onboarding: BOX is ingested via Box native connector (Bloo extractor 711). Integration guide: https://bloo.io/docs/hypercloud/box-connector BQL (Bloo Query Language): stream=documents where sourcename='BOX' and lower(visibility) like '%public%' | groupby user, file, visibility, srcip
Sigma
