Ticket types for users¶

Coro generates tickets for protectable users when it identifies the following security incidents:

• Access permission violation
• Mass data deletion
• Mass data download
• Suspected bot attacks
• Suspicious exposure of certificate
• Suspicious exposure of critical data
• Suspicious exposure of file type
• Suspicious exposure of password
• Suspicious exposure of source code

Access permission violation¶

Coro observed a login violation of the cloud app access permissions configured for a user group to which a user belongs, based on the origin country or IP address used in the login attempt. Tickets remain open for review by an Admin user and closed automatically after a period of time. To learn more, see Access permissions violation.

Mass data deletion¶

Coro observed an abnormally large data deletion event from the cloud app account of a protected user. These tickets are automatically closed. To learn more, see Mass event tickets.

Mass data download¶

Coro observed an abnormally large data download event from the cloud app account of a protected user. These tickets are automatically closed. To learn more, see Mass event tickets.

Suspected bot attacks¶

Coro identified a protected user account as being the target of a suspected bot login attempt from an external source. These tickets are automatically closed. To learn more, see Suspected bot attacks.

Suspicious exposure of certificate¶

Coro identified a user account that was involved in a potential data exposure event with monitored security certificates (files with a .crt or .pem extension used to establish a secure connection between a client and a server). This occurs where monitoring for Certificates was enabled (see Monitoring). These tickets are classified as suggested for review, with the period ranging from 1-2 weeks.

Suspicious exposure of critical data¶

Coro identified a user account that was involved in a potential data exposure event with monitored critical data (specific defined keywords in email and shared file content). This occurs where monitoring for Specific keywords was enabled (see Monitoring). These tickets are classified as suggested for review, with the period ranging from 1-2 weeks.

Suspicious exposure of file type¶

Coro identified a user account that was involved in a potential data exposure event with monitored file types (specific defined file types added as email attachements and in shared drive content). This occurs where monitoring for Specific file types was enabled (see Monitoring). These tickets are classified as suggested for review, with the period ranging from 1-2 weeks.

Suspicious exposure of password¶

Coro identified a user account that was involved in a potential data exposure event that included passwords. This occurs where monitoring for Passwords was enabled (see Monitoring). These tickets are classified as suggested for review, with the period ranging from 1-2 weeks. The duration depends on the potential impact of the detection.

Suspicious exposure of source code¶

Coro identified a user account that was involved in a potential data exposure event that included monitored source code files (files with a known code or script extension such as .md, .yaml, .sh). This occurs where monitoring for Source code was enabled (see Monitoring). These tickets are classified as suggested for review, with the period ranging from 1-2 weeks.