domains / families / security / detecting-s3-data-exfiltration-attempts

detecting-s3-data-exfiltration-attempts

separate

'Detecting data exfiltration attempts from AWS S3 buckets by analyzing

When to use

• When GuardDuty detects anomalous S3 access patterns such as bulk downloads from unusual IPs
• When investigating suspected data breach involving S3-stored sensitive data
• When building detection rules for S3 data loss prevention monitoring
• When responding to Macie alerts about sensitive data being accessed or moved
• When compliance requires monitoring and logging of all access to classified data stores

When not to use

• Preventing data exfiltration
• Data classification
• Network-level exfiltration detection

Skill page

Source