Bulk file download from sanctioned cloud storage apps (Netskope CASB)

KQL Cowboy@KQLCowboy

•updated Aug 18, 2026•3•0•8

Detects users who have downloaded more than 50 files from cloud storage applications within a single hour, potentially indicating data exfiltration or mass data harvesting.