Using Threat Detection

​

About Box Shield Threat Detection

The Threat Detection feature of Box Shield allows you to enable, configure, and apply a variety of security rules within your organization that alert you to deviations in a person’s usual work activities. To make configuring threat detection rules easier, Shield enables you to create lists of alert criteria, such as blocked countries or domains, that you can add to these rules. You can also specify where you want Shield alerts to be sent for evaluation. When you apply a threat detection rule, Box Shield monitors your account holders’ activities and uses machine learning to predict which potentially sensitive documents each monitored account holder would download under normal circumstances. When an account holder’s download activity significantly deviates from prediction, Shield alerts you. With Threat Detection, you can

• Detect malicious account holders who use their access to steal data or access content.
• Detect compromised accounts based on context such as locations, activities, and access patterns.
• Detect potential malware in content uploading to your enterprise’s Box account, and enforce downloading restrictions.
• Make important security decisions based on rules and behaviors.

​

Threat Detection Rules

Box Shield provides several Threat Detection rules that you can enable, configure, and apply. A detection rule watches for a specific type of anomalous event in account holders’ activity, and triggers a Shield notification when the rule detects the event. The rules include:

• Anomalous Download, which detects an account holder who may be stealing sensitive content.
• Malicious Content, which detects potential malware in content uploading to your enterprise’s Box account.  Malicious content rules offer multiple types of malware detection:
  • Reputation scan of threats by comparing your files to files known to contain malware
  • Deep scan of certain file types by evaluating the content of those files
  When Shield detects potential malware, Box
  • Displays a warning banner to all users accessing malicious content from the Box Web app,
  • Displays an alert on your Shield Dashboard, and
  • Enforces downloading restrictions you selected when you configured this rule.
    • On Box Drive for MacOS or Windows, download restrictions prevent people from opening, moving, or copying a malicious file.  Instead, a warning notification displays.
• Suspicious Location, which detects someone apparently accessing content from an unusual or excluded geographic location, host IP address, set of users or groups, or domains. You can define up to 25 different rules in the Suspicious Location rule, each configured to define specific monitoring characteristics.
• Suspicious Session, which detects instances of impossible travel characterized by rapid changes in user location, combined with unusual user agent strings and new IP addresses.
• Ransomware Activity, which seeks to identify instances of mass encryption on Box that would indicate a user’s device is compromised with ransomware.

You can create, edit, and delete a threat detection rule. After you enable, configure, and apply a rule, Shield uses the rule to monitor account activities in your enterprise.

​

Using the Shield Dashboard

​

Viewing Shield alerts

After you’ve started one or more detection rules, Shield Dashboard displays alerts for account activities that meet detection criteria. The alerts table displays the following columns, from left to right:

• Alert: name and type of the related detection rule
• Severity: the severity of the alert: Low, Medium, High, or Critical
• Target User: name and email address of the account holder whose activity triggered the alert
• Updated: date the alert was last updated

The Alerts by Severity widget summarizes how many alerts are at each severity level. The widget values reflect the rule types you filter by.

​

Viewing the list of Shield alerts

To view Shield alerts:

1. Go to Admin Console > Shield.
2. Click the Dashboard tab.

​

Filtering Shield alerts

To filter the alert list table:

1. Go to Admin Console > Shield.
2. Select the Dashboard tab.
3. In the Dashboard tab, above the alerts table, select a filter:
   • Rule Type
   • Severity (Low, Medium, High, or Critical)
   • Time span
4. Box displays the alert list table according to your selected filtering criteria.

​

Viewing a Shield alert’s details

To view an alert’s details:

1. Go to Admin Console > Shield.
2. Click the Dashboard tab.
3. In the alert list table, click an alert.
4. Box displays the alert detail page.

The alert detail page displays the following:

• Alert Summary provides a summary of the alert including alert name, alert ID, alert type, severity, and information about the criteria defined in the detection rule that triggered this alert.
• User Summary summarizes the target account for this alert, including email address, last login time, and group membership (as defined in Box). If group membership information is not populated in Box, this field can be empty.
• Geographic Activities summarizes on a geographical map the location of the account’s activity at the time of the alert.
• Content Accessed summarizes statistics for content accessed by the account at the time of the alert.
• User Activities summarizes the account’s activities, by activity type, at the time of the alert.
• Client Activities displays information about the clients that accessed content at the time of the alert. This information helps you delineate access from a corporate network as opposed to home or public networks.
• Alert Timeline displays a chronological list of the individual account activity that caused the alert.

​

Exclusions from Shield alerts

When you review the Alert Details page and see an application, IP address, user(s), or groups that you want to exclude from Suspicious Location and Suspicious Session alerts, next to the application’s name or the IP address click Exclude.

​

Understanding alert severity

Every Shield alert has a severity that indicates the alert’s urgency and its need for your attention. The severity levels are:

• Low
• Medium
• High
• Critical

For most rules, Shield calculates severity from the alert’s risk score. This is a value from 1 to 100 based on the likelihood of a detected threat; severity is how Shield displays that score. It doesn’t change how Shield detects threats or calculates risk scores. For Suspicious Location rules, the severity is the Alert Severity you select when you configure the rule. Severity displays as a colored badge in the Shield Dashboard alerts table and in the header of each alert detail page. Severity from the Anomalous Download rule The Anomalous Download rule analyzes download activity across your Box environment to detect when users change their download behavior. The severity reflects Shield’s confidence that the user’s download behavior differs from their previous activity enough that you should review it. Severity from the Suspicious Location rule The Suspicious Location rule uses the Alert Severity you select when you configure the rule. Every alert the rule generates has that severity: Low, Medium, High, or Critical. Severity from the Suspicious Session rule The Suspicious Session rule finds potentially compromised user accounts by detecting concurrent sessions originating from different geographical locations. The severity reflects Shield’s confidence that the concurrent sessions are an impossible travel event worth investigating. Severity from the Malicious Content rule The Malicious Content rule helps detect malware uploaded to Box. The severity reflects Shield’s confidence that the file is malware and needs further investigation.