Dropbox

Telemetry Evidence

These values show how indexed rules identify Dropbox telemetry.

Dropbox Admin sign-in-as Session source medium: Alerts when an admin starts a sign-in-as session.
Dropbox Document/Folder Ownership Transfer source medium: Dropbox ownership of a document or folder has been transferred.
Dropbox External Share source low: Dropbox item shared externally
Dropbox Linked Team Application Added source low: An application was linked to your Dropbox Account
Dropbox Many Deletes source: Dropbox Many Deletes
Dropbox Many Deletes source medium: Detects when a Dropbox user deletes more than 10 distinct files within 60 minutes. This may indicate accidental or malicious bulk deletion of team files. The threshold should be tuned to your environment.T1485
Dropbox Many Downloads source: Dropbox Many Downloads
Dropbox Many Downloads source medium: Detects when a Dropbox user downloads more than 10 distinct files within 60 minutes. This may indicate data exfiltration or unauthorized bulk access to team files. The threshold should be tuned to your environment.T1567
Dropbox User Disabled 2FA source low: Dropbox user has disabled 2fa login

These rules appear in a Dropbox source package, but their queries do not identify Dropbox telemetry. They do not count toward Rules.

Dropbox Many Deletes source medium: Detects when a dropbox user deletes many documents.
Dropbox Many Downloads source medium: Detects when a dropbox user downloads many documents.