Skip to main content
Exfiltration is the finding source for data leaving the estate. Three tabs: Queue, Rules, and Egress. Rules requires the manage alerts permission.

Tab: Queue

Movements that already earned a verdict — exfil findings to review, accept, or deny.

Tab: Rules

Detection rules in the exfil category. Same builder as Alerts, scoped to data-movement conditions.

Tab: Egress

The deep activity ledger behind those findings: uploads, downloads, and related file actions, with its own 1 / 7 / 30-day window. Open a row for host, path, actor, and timing. This is the former Activity / file-upload surface.
Last modified on October 8, 2026