Database or mail data sent out
A database file or dump, or a mail store, is read, then it or an archive or encoding of it is sent out.
Why it is risky
Section titled “Why it is risky”Database files, dumps and mail stores often hold customer or personal data. Sending them off the machine can be a data breach even when no credential is involved.
Example
Section titled “Example”An agent reads a database dump in a project’s backup folder, compresses it, and uploads the archive to a file-sharing service.
This is a fictional example, not an event from a customer.
What Omnodex Detects
Section titled “What Omnodex Detects”This advanced rule links a read of a database file or dump, or a mail store, with a later call that sends that file, or an archive or encoding of it, to another host.
| Rule ID | Event category | Tier | Base severity |
|---|---|---|---|
RULE_ADV_SENSITIVE_DATA_SENT | data_movement | Requires Pro | HIGH |
Base severity is the rule default. A finding involving content saved for later execution may have a lower severity. Your loaded rule version and event details determine the finding you see.
What to check next
Section titled “What to check next”Check what data the file held, where it went, and whether the transfer was expected. If it reached a host you do not control, follow your data incident process.
False positives
Section titled “False positives”Scheduled backups and database migrations move dumps to storage on purpose. Test fixtures with database extensions can also match.
False negatives
Section titled “False negatives”Data read through a database client, a query, or an API rather than from a file is not covered. Files with unrecognized names or formats can be missed.
Technical details
Section titled “Technical details”The rule matches files by kind and links calls by the paths they name. It does not read the files, so it cannot say what data they held. This advanced rule produces evidence with the finding: each call in the chain with its role, a one-line summary of what it did, where the last call went, and why the chain might be routine. In the hosted dashboard, related findings about the same chain are read together as one investigation. Availability depends on the advanced rule bundle loaded by the installation. Findings on activity captured by agent hooks appear when the session ends or at the next background pass, within about 15 minutes; activity through the MCP proxy is judged as it is recorded.
A finding describes a pattern in captured activity. Review the original calls, their results, and the task context before concluding that harm occurred. Absence of a finding does not establish that an operation is safe.