Classification:

detection-engine

Tactic:

TA0009-collection

Technique:

T1530-data-from-cloud-storage

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects when a Cisco Duo log export is initiated by any actor, which may indicate data collection or staging for exfiltration of event history.

Strategy

This rule monitors Cisco Duo activity logs for log_export_start events. This event captures any log export initiation regardless of actor type, providing broad coverage while relying on analyst review to distinguish authorized automated exports (expected as rare, system-initiated) from interactive exports by human or API actors.

Triage and Response

• Identify the actor {{@usr.email}} that initiated the log export and determine whether this was expected — for example, a scheduled automated process or an approved admin action.
• Review the timing of the export relative to other recent admin activity for {{@usr.email}}, including any recent logins from unusual locations, failed authentication attempts, or permission changes.
• Determine the scope of the exported logs: check whether the export covered all users, specific applications, or a particular time range, which can indicate what data was targeted.
• Examine whether a log_export_complete or log_export_failure event followed this start event to determine whether the export succeeded and how much data may have been collected.
• Verify whether any external data transfer events correlate with the log export completion, which could indicate the exported data was sent to attacker infrastructure.