Anomalous Download Detection Rule

The Anomalous Download detection rule is a feature within Box Shield. It helps prevent data leakage and theft by flagging suspicious download activity across your Box environment. You choose what triggers an alert. Enable either or both of these criteria:

Anomaly detection: Box alerts you when a user’s downloads deviate sharply from their normal behavior. Monitors managed users only.
Threshold limits: Box alerts you when downloads exceed a number or volume of files that you set. Monitors managed and external users.

Create, edit, and delete Anomalous Download detection rules

To create or change this detection rule, you need admin rights (or co-admin rights with the Create, edit, and delete Shield configuration for your company permission enabled) in an account with the Box Shield add-on enabled. See our dedicated page for creating, editing, and deleting threat detection rules for a step-by-step guide.

Only one Anomalous Download detection rule can be created for each Box account.

Anomaly detection

Anomaly detection monitors user activity and uses Box machine learning to understand normal download behavior for users within your organization. It generates alerts when these users deviate sharply from typical patterns. Anomaly detection monitors only managed users.

Configure threshold limits

You configure threshold limits in the Select Criteria section when you create or edit the Anomalous Download rule. Threshold limits monitor managed and external users. To set up threshold limits:

Turn on Enable Threshold Limits.
Select Add threshold, then select a threshold type:
- Number of files downloaded: In the Limit field, enter the number of files. The minimum is 10.
- Volume of files downloaded: In the Limit field, enter a number, then select GB or TB.
In the Time Window menu, select a rolling period from 1 hour to 24 hours.
(Optional) To add the other threshold type, repeat steps 2 and 3. Each rule supports one threshold of each type.
(Optional) To exclude specific download types from threshold limits, select one or both of the following:
- Exclude public shared link downloads: Downloads through shared links set to People with the link don’t count toward threshold limits.
- Exclude Box Drive downloads: Downloads through Box Drive don’t count toward threshold limits.
(Optional) To count download activity from specific integrations only, select Limit impacted integrations, then select one of the following:
- Monitor only selected services: Only download activity from the integrations you enter counts toward the threshold limit.
- Exclude selected services: Download activity from the integrations you enter doesn’t count toward the threshold limit.
Start typing an integration name, then select it from the list. You can add multiple integrations.
In the Alert Severity menu, select Low, Medium (default), High, or Critical. Every alert generated by a threshold limit has this severity.

Box generates a maximum of three threshold limit alerts per hour for a single user. This limit prevents excessive alerts while still showing you when a user repeatedly exceeds a threshold.

Low threshold limits can trigger a high volume of alerts. Before you finalize your threshold limits, run a User Activity report to review typical download activity in your enterprise.

Before you start the rule, the review page shows whether Anomaly Detection and Threshold Limits are enabled. After you start the rule, threshold limits can take up to 10 minutes to become active.

Anomalous Download alerts

An alert will display in the Shield Dashboard when Anomalous Download activity is detected. Alerts include the Alert ID, date, the name and email address of the account holder whose activity triggered the alert, the severity, and the IP address whose access triggered the alert. To view an alert’s details:

Go to Admin Console > Shield.
Select the Dashboard tab.
(Optional) Filter the alerts for Anomalous Download.
In the alert list table, select an alert.
Box displays the alert detail page.

Every Anomalous Download alert includes an Alert Trigger field that shows what generated the alert: Anomaly Detection, Number of files downloaded, or Volume of files downloaded. The rest of the alert detail page depends on the trigger.

Anomaly detection alerts

The alert detail page displays the following:

Alert Summary: overview of the alert including alert name, alert ID, alert type, severity, alert created date, alert trigger, anomalous activity date range, anomalous download delta, and the target user.
Download Details: information regarding the download activity that triggered the alert, including a comparison between the user’s historical activity and the anomalous activity. Additional information such as the IP addresses, IP registrants, and any available device information will be shown.
Anomalous Content Downloaded: Gives a full breakdown of the files downloaded by the target user during the anomalous period.

Threshold limit alerts

A threshold limit alert triggers as soon as download activity exceeds the limit. The alert detail page shows only the downloads that happened up to that point, not any downloads that happened after the alert was generated. The alert detail page displays the following:

Alert Summary: overview of the alert including the alert trigger, risk score, severity, alert created date, and the target user.
Download Details: the download activity that exceeded the threshold limit, including the start and end date and time, number of files downloaded, volume downloaded, and the services used. A warning icon marks the value that exceeded the limit. A side panel shows the threshold type, threshold limit, and time window. To change the threshold, select Manage Threshold.
Content Downloaded: the distinct files downloaded during the activity period, up to 1,000 files. For each file, the table shows the name and file path, size, service used, date downloaded, and download frequency. The table lists the most recent downloads first, 25 files per page.

You can view the number of alerts in the past week from the Detection Rules page. For longer timeframes, check the Shield Dashboard.

A feedback box is displayed on the dashboard after an alert. This enables you to provide suggestions and comments to Box which helps to improve functionality.

End user implications

If anomalous download activity is detected from a user’s account, the end user is not notified – only Shield admins are alerted of the activity.
No user restrictions will be applied when an Anomalous Download alert is triggered.