Box Preview-Then-Download Sweep Across Unrelated Files
Detects a pattern of previewing many files then downloading a subset. This is browsing behaviour — an intruder assessing what is worth taking before taking it — and it differs from normal use, where a user opens files they already know about. The preview-to-download ratio is the discriminator, not the raw volume of either. Onboarding: BOX is ingested via Box native connector (Bloo extractor 711). Integration guide: https://bloo.io/docs/hypercloud/box-connector BQL (Bloo Query Language): stream=documents where sourcename='BOX' and action='PREVIEWED' | duration 1h | groupby user | select user, distinct_count(file) | having distinct_count_col1 > 30
Sigma
