Techniques › T1213.001 › AN1019
AN1019 Analytic 1019
SaaS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection of excessive or programmatic access to Confluence spaces or pages, particularly by privileged users, through a combination of access logs, API usage, and identity context. Correlates logon sessions, user roles, and abnormal document viewing or export behavior. Identifies burst access patterns and tools/scripts abusing the Confluence API for mass enumeration or data scraping.</p>
- Detects
- T1213.001 Confluence
- Part of
- DET0358 Programmatic and Excessive Access to Confluence Documentation
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| saas:confluence | access.content | DC0038 Application Log Content |
| saas:confluence | logon | DC0067 Logon Session Creation |
| saas:confluence | REST API access from non-browser agents | DC0085 Network Traffic Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Defines the time span (e.g., 5m, 1h) in which excessive access behavior becomes suspicious. |
UserContext | Privileged user roles (e.g., domain admins) should be excluded or flagged if found accessing documentation repositories. |
AccessThreshold | The number of pages viewed or exported by a single user before triggering detection logic. |
AgentFilter | User agent strings that may indicate scripted, automated, or non-interactive access methods. |