Data exports and outbound transfers

Where did the agent send data?

Follow data from local files to outbound transfers. Teleport links exports, staging and uploads to the recorded activity, so you can see what moved and what still needs checking.

Review the evidence See the classifier

Example shown: data staged in a recorded SSH session.

Teleport data-exfiltration finding: a CSV was archived and Base64-encoded in an outbound staging directory. No completed remote transfer is shown. The finding is marked for review with Critical risk.
A staging finding that distinguishes preparation from a completed transfer.

See how the data was staged.

This SSH session created a customer CSV, compressed it and Base64-encoded the archive in an outbound staging directory. The finding links those actions to the session record.

  1. 0:10

    A CSV is created

    The terminal writes sample customer IDs, email addresses and account balances to customers.csv.

  2. 0:12

    The export is archived

    A tar command compresses the files into customer-database-export.tgz in outbound-staging.

  3. 0:14

    The archive is encoded

    The archive is Base64-encoded. At 0:16, the timeline shows file hashes and a listing of the staged files.

No completed remote transfer or upload destination is shown. This match flags staging; it does not establish that data left the host. Check the task, any later transfer and its authorization.

Teleport review of the staged customer export. The event detail connects the archive command to the data-exfiltration finding and the Archive Collected Data technique.
The recorded activity explains why the session was flagged.
View the full SSH session screenshot
Full Teleport SSH session review, including the sample CSV creation and archive command, session summary, data-exfiltration finding and timeline.
The original session view, including the terminal and staging events.

See what the classifier looks for.

The built-in data-exfiltration classifier reviews SSH, Kubernetes and database sessions for data leaving the host or being staged for transfer. Duplicate it to adapt the criteria and choose what happens on a match.

Enabled built-in data-exfiltration classifier for SSH, Kubernetes and databases. Its criteria cover uploads, exports and staging, with actions to emit an audit event, flag for review and raise risk to Critical.
Session kinds, criteria and match actions in one configuration. Scroll the screenshot horizontally to inspect it.

Data exfiltration / movement

SSH, Kubernetes and databases

Looks for outbound file transfers, cloud uploads, database exports and data staged for transfer. Inbound downloads, package installs and configuration pulls are excluded.

View detailed criteria

Identify data leaving a host or being staged for an outbound transfer.

  • Outbound file transfers to remote hosts with scp or rsync.
  • Uploads of local files over HTTP, including curl -T, --upload-file, or POST / PUT requests carrying local data.
  • Uploads to cloud object storage, including aws s3 cp / sync, gsutil cp and az storage blob upload.
  • Bulk SQL exports to files, including COPY ... TO and SELECT ... INTO OUTFILE / DUMPFILE.
  • Database dumps using pg_dump, mysqldump, mongodump or similar utilities.
  • Archiving data with tar, zip, gzip or 7z, followed by a transfer or upload to another host.

Evaluated after session summarization; findings are reviewed against the recording.

See classifier setup
View classifier activity and recent matches
Full data-exfiltration classifier page with match activity and two recent SSH sessions marked Critical, each linking to its recording.
Recent matches link back to the recordings that need review.

Turn the match into a review.

Open the original recording, establish the context and document the outcome.

  1. 01

    Follow the data

    Connect the source data to the CSV, archive and encoded file. Check what the recording establishes before concluding that data left the host.

  2. 02

    Check for a transfer

    Look for a later upload, transfer result or receiving host. If a destination is recorded, identify its owner and confirm whether it was approved.

  3. 03

    Assess the movement

    Confirm the data sensitivity and task authorization. Record approved test or backup activity, or route unexpected staging or transfers for review with the evidence.

See the session investigation workflow

Bring your investigation to Teleport Beams.

Explore session capture, classification and evidence review for your environment. Contact us about classifier availability and deployment requirements.

Launching November 9. Join the waitlist for launch updates.