Use Case: Insider Threat
Excessive external sharing
A senior engineer shared a 'confidential' marked folder containing Q4 roadmap documents via 'anyone with the link'. The folder had 847 files. ManySignal detected the sensitivity + breadth combination and revoked the link within 2 minutes.
The convenience setting that exposed the roadmap
External sharing settings in Microsoft 365 and Google Workspace are designed for collaboration. But "anyone with the link" is a nuclear option — it makes the content effectively public. Users who set this for convenience (sharing a large folder with a vendor rather than adding individual email addresses) often apply it to folders containing far more than the one document they intended to share.
The detection challenge is signal density — external sharing is common, legitimate, and frequent. ManySignal reduces false positives by evaluating the combination of factors: what was shared, how broadly, with what classification, by whom, and relative to their historical sharing behavior.
rule: excessive_external_sharing
type: dlp + behavioral
sources:
- microsoft_365_unified_audit
- google_workspace_drive_audit
- box_event_log
trigger:
- condition: |
sharing.link_type == "anyone_with_link"
AND (file.classification IN ["confidential", "restricted"]
OR file_count > 100)
- OR:
- condition: |
sharing.recipient_domain NOT IN approved_vendor_domains
AND sharing.volume_7d > user_baseline_p95 * 3
enrichments:
- data_classification: purview, nightfall, file_path_patterns
- recipient_analysis: known_vendor, personal_email, competitor
- user_risk: departing, insider_risk_score
- revocation_action: m365_graph, gsuite_admin
mitre: T1567.002 (Exfiltration to Cloud Storage)MITRE ATT&CK mapping
External sharing FAQ
What external sharing events trigger alerts?
Any-with-link sharing (no authentication required), sharing to personal email domains (gmail.com, yahoo.com, hotmail.com), sharing to domains not in the approved vendor list, sharing files classified as confidential or restricted, and sharing volumes that significantly exceed the user's historical external sharing pattern.
Can ManySignal revoke external sharing links automatically?
For Microsoft 365 and Google Workspace, yes. An over-broad sharing link can be revoked via the admin API as an autonomous action. For sensitive data classifications, revocation can be configured to trigger automatically without waiting for analyst approval.
How does ManySignal classify files that don't have explicit DLP labels?
ManySignal uses three complementary classification approaches: existing DLP labels from Purview, Nightfall, or Google Cloud DLP; file path/naming patterns that indicate sensitivity (files in /HR/, /Legal/, /Financial/ paths, files named 'confidential', 'restricted', 'NDA'); and a sampling-based content scan for unclassified files in high-risk sharing events.
Does this cover SharePoint and OneDrive in addition to Google Drive?
Yes. Microsoft 365 sharing events (SharePoint, OneDrive, Teams file sharing) are monitored via the Unified Audit Log. Google Workspace Drive sharing is monitored via the Admin SDK Reports API. Box and Dropbox Business are supported via their respective event APIs.
Close overly broad sharing links before sensitive data is accessed externally
Sharing event monitoring with data classification and automated revocation for high-risk shares.