Take action on user based on Threat Detection Shield Rule
Extending threat detection ALERTS to take action on a user's access would be very valuable. I've heard lots of customers request having a user's account deactivated if they access Box from a suspicious location. Right now, there is not a way to do this through the core Box application, it has to be done through custom scripting or with another tool.
Anonymous
shared this idea
An automated response action to restrict a managed user was released in 2023 for our Suspicious Location detection rule. As we build out new alert pages for our other detections, actions are being evaluated.
-
AdminAnonymous
(Admin, Box)
commented
to be released Oct/Nov 2023
-
AdminAnonymous
(Admin, Box)
commented
This would also be valuable for anomalous activity and downloads.
E.g. Admin can configure a specific threshold for anomalous downloads --> if a person downloads 1000% more sensitive information than normal, then we suspend their account until the Admin and/or Co-Admin and/or InfoSec team approves the activity.