Take action on user based on Threat Detection Shield Rule
Extending threat detection ALERTS to take action on a user's access would be very valuable. I've heard lots of customers request having a user's account deactivated if they access Box from a suspicious location. Right now, there is not a way to do this through the core Box application, it has to be done through custom scripting or with another tool.
![](https://secure.gravatar.com/avatar/68774fd8c880da81e4d0936f63b640ae?size=40&default=https%3A%2F%2Fassets.uvcdn.com%2Fpkg%2Fadmin%2Ficons%2Fuser_70-6bcf9e08938533adb9bac95c3e487cb2a6d4a32f890ca6fdc82e3072e0ea0368.png)
Automatically logging user out from suspicious locations is on the roadmap for FY23.
-
AdminAnonymous (Admin, Box) commented
to be released Oct/Nov 2023
-
AdminAnonymous (Admin, Box) commented
This would also be valuable for anomalous activity and downloads.
E.g. Admin can configure a specific threshold for anomalous downloads --> if a person downloads 1000% more sensitive information than normal, then we suspend their account until the Admin and/or Co-Admin and/or InfoSec team approves the activity.