---
title: Workday user downloads multiple reports
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > Workday user downloads multiple reports
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Workday user downloads multiple reports
Classification:attackTactic:[TA0010-exfiltration](https://attack.mitre.org/tactics/TA0010)Technique:[T1567-exfiltration-over-web-service](https://attack.mitre.org/techniques/T1567) 
## Goal{% #goal %}

Detect when a single user downloads an unusually high number of different report types from Workday within a short time period.

## Technical Context{% #technical-context %}

Workday is our Human Resources Information System containing sensitive employee data. When a user downloads many different types of reports in a short timeframe, this could indicate reconnaissance activity or data exfiltration attempts. Legitimate business use typically involves downloading specific reports for defined purposes, not mass collection of diverse report types.

## Triage and Response{% #triage-and-response %}

Refer to the following fields when investigating:

- User: `{{@usr.email}}`
- Number of different reports downloaded: `{{unique_reports}}`

1. Review the user's role and job responsibilities to determine if downloading multiple different reports is justified for their position.
1. Examine the specific report types being downloaded (`@evt.name`) to assess the sensitivity and scope of data accessed.
1. Check the IP addresses and user agents for relevant threat intelligence or suspicious characteristics.
1. Look at the timing pattern of downloads. Rapid sequential downloads may indicate automated collection.
1. Review recent and historical Workday activity by the user (`{{@usr.email}}`) for any abnormal patterns of behavior.
1. Reach out to the user's manager or HR team to verify whether the activity is expected.
1. If the nature of the activity is suspicious and requires further investigation, declare an incident.