Data movement
This category groups advanced rules that follow sensitive data from where it was read, through any archiving or encoding, to where it was sent: database files and dumps, mail stores, archives and source code. Credential movement is in Credentials and sensitive data. A finding is a reason to review the activity and its context, not proof that a breach occurred.
Risk types
Section titled “Risk types”- Sensitive file read before reaching a new host (Requires Pro)
A credential, environment, database or mail file is read, then the machine reaches a host it has never reached before.
- Database or mail data sent out (Requires Pro)
A database file or dump, or a mail store, is read, then it or an archive or encoding of it is sent out.
- Archive sent to a new host (Requires Pro)
An archive is built and sent to a host the machine has never reached before.
- Code pushed to a new git host (Requires Pro)
Code is pushed to a URL on a git host the machine has never reached before.
Event categories
Section titled “Event categories”These event category values map to this library category: data_movement. Use the rule index to find the explanation for a specific rule ID.