Mass event tickets¶
Suspicious exposure of sensitive information tickets contain:
- Mass Data Download
- Mass Data Deletion
Mass Data Download and Mass Data Deletion tickets are created when abnormally massive data deletion or data download occurs from cloud application accounts of individual users.
Suspected Bot Attacks, Mass Data Deletion, and Mass Data Download are detected using techniques similar to those discussed in the context of Suspected Identity Compromise and Abnormal Admin Activity See Cloud Apps. Coro essentially creates normative and non-normative models for individual users, customers as an organization, and a set of global models capturing the patterns of all Coro customers.
Suspicious exposure of sensitive information tickets, on the other hand, are implemented using various techniques aimed at identifying the specific types of objects of interest in these tickets.