As enterprises adopt Box Agents, AI-driven automation, and third-party integrations, security teams face a new class of programmatic risk. Traditional detection rules assume human behavior like typical office hours and manual sharing patterns. Automated actors do not work that way. They traverse repositories, aggregate knowledge, and move data at machine speed, often appearing in the event stream as standard users acting through service IDs.
Threshold based alerting extends the existing Anomalous Download rule in Box Shield so admins can define exactly what counts as too much, too fast. You set the limits that match your risk tolerance, and Shield alerts you when any identity, whether a user, agent, or service account, crosses them.
What's new
Admins can now configure global thresholds within the detection rule. Each rule supports one threshold today, with multiple thresholds under consideration for a future release.
Configurable options include:
- File count or download volume. Set a limit on the number of files downloaded, or on total download volume in GB or TB.
- Rolling time window. Specify the lookback evaluation window, choose any duration from 1 hour up to 24 hours , across which download counts or volumes are continuously measured against your threshold
- Service scope. Build an allow list of integrations to monitor, or a deny list of integrations to exclude from the count. Both fields look up registered integrations in your enterprise.
- Alert severity. Assign a static severity of Low, Medium, High, or Critical to every alert generated by the threshold. The default is Medium.
Richer alert details
When a threshold is breached, the alert page gives admins the full picture:
- The title card shows an Alert Trigger field for the threshold that fired, and existing anomaly alerts now read "Anomaly Detection" in the same field. The Download Details card summarizes the activity that exceeded the limit, including start and end time, file count, volume, and services used, with icons on the values that crossed the threshold.
- A side panel repeats the configured threshold at a glance and includes a Manage Threshold link that routes to the rule configuration page.
- A Content Downloaded card lists every distinct file touched during the anomaly period, up to 1,000 files, sorted by most recent download.
The detection rule summary page also surfaces the status of both Anomaly Detection and Threshold Limit at a glance, so admins can confirm their coverage without opening each rule.
Built into the Shield event stream
Threshold triggered alerts flow through the existing Shield alert event schema. The alert summary now carries the configured threshold (type, limit, window), the download date range, file count, volume, and services used, so downstream SIEM and SOAR workflows pick up the signal automatically.
Why it matters
Threshold based alerting gives security teams a precise way to catch programmatic exfiltration before it spreads, protect sensitive repositories from bulk aggregation, and unblock enterprise rollouts of external AI Agents with confidence.
Admin action required
Threshold based alerting is available as part of Box Shield. To turn it on, open the Anomalous Download rule in Box Shield, enable Threshold Limit, and set the options above to match your policy. Existing anomaly based detection continues to run as it does today.