T1213.001 — Confluence

Tactic: Collection · Platforms: SaaS

Adversaries may leverage Confluence repositories to mine valuable information. Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation, however, in general may contain more diverse categories of useful information,…

Sub-technique of Data from Information Repositories (T1213).

Sigma detection rules (1)

T1213.001 Data from Information Repositories: Confluence

title: "T1213.001 Data from Information Repositories: Confluence"
id: cb95b46f-f2fa-4a3f-8bbf-b9878b601cd9
description: 'Programmatic and Excessive Access to Confluence Documentation. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: TimeWindow, UserContext, AccessThreshold, AgentFilter.'
references:
  - https://attack.mitre.org/techniques/T1213/001
author: Shahrukh Khan
date: 2026-02-25
license: MIT
tags:
  - attack.collection
  - attack.t1213.001

logsource:
  product: saas
  service: confluence

detection:
  selection_view:
    category: 'content'
    action: 'page_viewed'
  selection_export:
    category: 'export'
    action|contains:
      - 'exported'

  condition: selection_export or selection_view

falsepositives:
  - Normal knowledge-base browsing by employees; distinguishing bulk collection from routine reading requires an access-count threshold and agent-string filtering over a time window.

level: low

Related sub-techniques

Explore