Can you see risky user behavior in Box?

A user creating a shared link to a file in Box may not be concerning on its own. But a watchlist user sharing Box links from a new geolocation after accessing sensitive customer data for the first time is.

Varonis gives you the ability to quickly correlate alerts in your cloud and on-prem environments to user behavior in Box.

Get the full picture

Search a complete forensics audit trail of Box activity to quickly see the who, what, when, where details.

View Box events in context with activity from other platforms, so you can quickly and conclusively investigate an incident.

Threat hunt like a pro

Save threat hunting queries that correlate risky Box activity with other Varonis data streams to surface potential attacks such as:

Icon_StaleUser

Shared links created by disabled or stale AD users

Icon_Permissions

Permission changes on highly sensitive folders

Icon_BruteForce

Box file downloads by users who triggered brute-force or geohopping alerts

Quick investigations at your fingertips

How would you know if a security incident in O365 also affected your Box instance? Pivot from 365 to on-prem storage to Box in seconds, without hopping between disparate tools and logs.

1 Get context-rich alerts on abnormal user behavior
2 Drill into the specific events that triggered the alert
3 Quickly pivot to see what the user has been doing in Box

Level-up your Box security event auditing

Our partnership with Box provides unlimited API calls for the Varonis application and won’t impact your quotas.

Sharing link activity
User admin role changes
User impersonations
User login activity
User changes
Security group changes
Object renames
Device associations
File & folder creates
File & folder deletes/restores
File & folder moves/copies
File & folder uploads/downloads
File & folder permission changes
File locked/unlocked
Organization invitations
File & folder invitations

FAQ

  • What are the installation prerequisites?

    You’ll need a valid Varonis Box Security Events license, a probe or collector that can reach https://api.box.com, and a custom Box application that takes just a few minutes to configure.

  • Does Varonis resolve geolocation from user IP addresses?

    Yes. For each Box event, we will resolve the user’s country based on their client IP address.

Want to see Varonis in action?

Request a Demo