Bitbucket Full Data Export Triggered
Detects when full data export is attempted.
Sigma rule (View on GitHub)
1title: Bitbucket Full Data Export Triggered
2id: 195e1b9d-bfc2-4ffa-ab4e-35aef69815f8
3status: experimental
4description: Detects when full data export is attempted.
5references:
6 - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
7 - https://confluence.atlassian.com/adminjiraserver0811/importing-and-exporting-data-1019391889.html
8author: Muhammad Faisal (@faisalusuf)
9date: 2024-02-25
10tags:
11 - attack.collection
12 - attack.t1213.003
13logsource:
14 product: bitbucket
15 service: audit
16 definition: 'Requirements: "Advance" log level is required to receive these audit events.'
17detection:
18 selection:
19 auditType.category: 'Data pipeline'
20 auditType.action: 'Full data export triggered'
21 condition: selection
22falsepositives:
23 - Legitimate user activity.
24level: high
References
-
At times, you may need to import or export data to or from Jira. You may want to import data from another tool (like Github or Fogbugz), another Jira instance, or from a manually prepared file such...
Read More
Related rules
- Bitbucket Unauthorized Full Data Export Triggered
- Github Delete Action Invoked
- Github Outside Collaborator Detected
- Github Self Hosted Runner Changes Detected
- 7Zip Compressing Dump Files