Bitbucket Audit Logs: Full Data Export Triggered

title: "Bitbucket Audit Logs: Full Data Export Triggered"
id: 9eea3631-956d-497f-8cfe-96393bc0e934
status: test
description: This rule flags audit events in Bitbucket indicating that a full data export was triggered. Full exports can expose large volumes of repository data, making them a common step in data collection and exfiltration workflows. The detection relies on Bitbucket audit telemetry fields for the audit type category and the specific action associated with the export trigger.
references:
  - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
  - https://confluence.atlassian.com/adminjiraserver0811/importing-and-exporting-data-1019391889.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/bitbucket/audit/bitbucket_audit_full_data_export_triggered.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2024-02-25
tags:
  - attack.collection
  - attack.t1213.003
logsource:
  product: bitbucket
  service: audit
  definition: 'Requirements: "Advance" log level is required to receive these audit events.'
detection:
  selection:
    auditType.category: Data pipeline
    auditType.action: Full data export triggered
  condition: selection
falsepositives:
  - Legitimate user activity.
level: high
license: DRL-1.1
related:
  - id: 195e1b9d-bfc2-4ffa-ab4e-35aef69815f8
    type: derived