All alarms
HighData exfiltrationACTIVE

Pre-exfiltration data staging in warehouse

10.4.19.66 → db-tier · warehouse-2 · updated 3h ago

Summary

Customer records are being read sequentially and compressed into a temp share — classic staging ahead of exfiltration.

Incident timeline
  1. Detected11:16:40Deep-Trace

    Deep-Trace flagged a large sequential read + compression job from a non-analytics account.

  2. Suggested action11:17:05Aegis-ID

    Aegis-ID proposed revoking the account session and blocking egress to unknown destinations.

Triage

Set the incident status:

Detection
Detected by
Pathfinder
Category
Data exfiltration
Opened
3h ago

Sensitive data leaving the perimeter.