Skip to main content
Tier One
High

Large upload of CAD files to a personal cloud storage account

A-1051

00:00time on this alert, target 10 minutes

Back to queue

Alert details

Source
DLP
Detection rule
DLP-EXFIL-PERSONAL-CLOUD-003
Affected user
l.nowak
Affected host
WKS-ENG-07
Source IP
162.125.248.20
First seen
2026-07-24T15:02:00Z

Why this fired, in plain English

Files marked as confidential were uploaded to a cloud storage account that is not owned by the company.

Suggested playbook

Data exfiltration to external storage

  1. 1. Determine whether the destination account is corporate or personal.
  2. 2. Compare volume against the host's own baseline, not an absolute number.
  3. 3. Identify the process: a backup agent and a browser upload mean very different things.
  4. 4. Check the classification and how many files were involved.
Open the full checklist

Raw log evidence

Exactly what the tools recorded — 3 events.

  1. Guided hint: this line matters

    ts=2026-07-24T14:51:03Z host=SRV-FILE-03 EventID=5145 account="l.nowak" share="\\\\SRV-FILE-03\\CAD-Designs" object="Turbine_Assembly_Rev12" access="ReadData" file_count=1184

    5145 = a network file share was accessed. 1,184 files in one burst is far above normal.

  2. Guided hint: this line matters

    ts=2026-07-24T14:58:12Z host=WKS-ENG-07 src="dlp" event=upload dest_domain="dropbox.com" account_type=personal classification="Confidential-Engineering" bytes_out=2841993216 file_count=1184 result=allowed

    2.8 GB going to a personal (not corporate) Dropbox account, and the DLP allowed it.

  3. Guided hint: this line matters

    ts=2026-07-24T14:30:11Z src="hris" event=status_change user="l.nowak" field="employment_status" old="active" new="notice_period" effective="2026-08-07"

    HR records show the employee resigned and is working her notice period.

Related events

The order things happened in.

  1. 14:30Z

    HR marks user as on notice period

  2. 14:51Z

    1,184 CAD files read from the share

  3. 14:58Z

    2.8 GB uploaded to personal Dropbox

Enrichment lookups

Mock lookups. Run each one yourself — a real analyst never guesses what a lookup would have said. There is no "run everything" button on purpose.

0 of 4 lookups checked

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

techniques

Your verdict

Keyboard shortcuts 1–4, or click. You can always change your mind afterwards.