data-exfiltration-detection

name	Data exfiltration detection
description	Assess possible data movement using destinations, protocols, volume, files, and user context. Identify evidence gaps and recommend low-risk validation and containment actions.

Data exfiltration detection

Assess possible data movement using destinations, protocols, volume, files, and user context. Identify evidence gaps and recommend low-risk validation and containment actions.

Output requirements:

• Cite observed evidence from the ticket.
• Mark unknown values as unavailable.
• Return structured JSON fields when requested.
• Do not change ticket status or execute commands.