---
title: >-
  Zscaler Internet Access firewall anomalous outbound data transfer volume by
  user
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Zscaler Internet Access firewall
  anomalous outbound data transfer volume by user
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Zscaler Internet Access firewall anomalous outbound data transfer volume by user
Classification:attackTactic:[TA0010-exfiltration](https://attack.mitre.org/tactics/TA0010)Technique:[T1048-exfiltration-over-alternative-protocol](https://attack.mitre.org/techniques/T1048) 
## Goal{% #goal %}

Detects an anomalous increase in a user's outbound data transfer volume through the Zscaler Internet Access firewall relative to their own historical baseline, which may indicate data exfiltration activity.

## Strategy{% #strategy %}

This rule monitors Zscaler Internet Access firewall logs for OCSF Network Activity events (`@ocsf.class_uid:4001`) where traffic was permitted (`@ocsf.status_id:1`). It aggregates `@ocsf.traffic.bytes_out` per user across all destinations over a one-hour window and uses anomaly detection with a 24-hour learning period and a tolerance of 5 rather than a static byte threshold. This allows each user's historical outbound volume to serve as their baseline: a consistently heavy uploader does not trigger the rule, but an unusual spike relative to that user's normal behavior does. Grouping by user alone, rather than by user and destination IP address, prevents the total from being fragmented across multiple destination IP addresses. Otherwise, an aggregate transfer could evade detection when spread across a rotating or load-balanced set of destinations, such as cloud storage services or content delivery networks (CDNs). A sudden increase in outbound volume is uncommon in normal user activity and may indicate bulk data staging or exfiltration over standard network protocols. In this technique, adversaries use permitted firewall paths to transfer sensitive data outside the organization.

## Triage and Response{% #triage-and-response %}

- Determine if `{{@ocsf.src_endpoint.owner.name}}` has a legitimate business reason to transfer large volumes of data within a one-hour window.
- Review the destination IPs involved in the transfer to determine if they belong to a known cloud storage provider, corporate system, or an unrecognized external host.
- Examine recent activity from `{{@ocsf.src_endpoint.owner.name}}` for signs of data staging, such as access to file shares, repositories, or sensitive data sources prior to the transfer.
- Check whether the transfer volume is consistent with the user's historical outbound traffic patterns.
- Identify the application or protocol responsible for the outbound transfer and determine if it is sanctioned for use in your environment.
- Review any concurrent alerts for `{{@ocsf.src_endpoint.owner.name}}` that may indicate account compromise or insider threat activity.