Log every export, download and bulk read with the actor, dataset, row count and destination. Then alert when a single event is far above that actor's normal size, when many records are read quickly, or when an account exports for the first time. Start with a few simple thresholds and tune them on real data.
Why exports are a good signal
Data theft by a stolen account or a malicious insider often ends in a large read. The attacker may have been quiet for days, but the export is hard to hide. It is also an action normal users take rarely, which makes it a good candidate for detection.
The OWASP Logging Cheat Sheet lists data import and export, and access to sensitive data, among higher risk functionality to log. It also lists excessive use as an optional event class, and the Logging Vocabulary has names such as excess_rate_limit_exceeded for limits that are crossed.
What to record
- Actor, tenant and role.
- Export type: report, CSV, API list call, backup, admin tool.
- Dataset or record type and how many rows.
- Filter used, so you can tell a narrow export from a full table.
- Destination: direct download, email, storage bucket, third party.
- Duration and request ID.
- Whether MFA was recently satisfied.
Row count and filter are the two fields teams most often skip, and the two that matter most.
Four starter rules
| Rule | Logic | Why |
|---|---|---|
| Size spike | Row count above a multiple of the actor's own median, or above a fixed ceiling | Catches full table pulls |
| Speed | Many list or detail calls within a short window | Catches scripted scraping through the API |
| First time | Actor with no prior exports now exports | Catches new use of a stolen account |
| Odd context | Export from a new device, country or after a failed MFA | Combines two weak signals into one strong one |
Pick numbers from your own history. Look at two weeks of normal exports, find the ninety fifth percentile, and set the alert a little above it. Re-check monthly.
Reduce noise
Exclude service accounts that run scheduled jobs, but alert if they change behaviour. Group by actor so one noisy export does not page ten people. Route low severity alerts to a ticket queue and reserve paging for combinations such as a size spike plus a new device.
Pair detection with prevention. Cap export size per request, require a recent MFA check for large exports, and email the account owner when one runs. Where a user does not need raw data, offer a filtered report.
Test the rule
Run an export from a test account that exceeds your threshold and confirm the alert reaches a person with enough detail to act: who, what, how much, where to. An alert that says only "export anomaly" will be ignored. See alert runbook template.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What if our customers legitimately export a lot?
Baseline per customer and per role, so each account is compared with its own history.
Is row count enough?
It is a start. Add the dataset sensitivity, since ten thousand rows of marketing data differs from ten thousand customer records.
Safeguard's continuous monitoring watches your dependencies for new findings after release. Try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
