daily_brief
Combine recent external file access events with current external sharing state to identify potential data leakage risks in Box.
Instructions
Morning DLP brief: external access (events) + external-sharing state (enumeration).
One call that combines:
access (enterprise-wide, events): external DOWNLOAD/PREVIEW in the last
since_hours, with top external accessors and top externally-accessed files.exposure (co-admin visible folders, enumeration): current external collaborations, open ("anyone with the link") shared links, and the owners most externally exposed.
Reuses the cached folder scan, so calling this alongside the other enumeration
tools doesn't re-walk. Args mirror the underlying tools; top defaults to 5
for a compact summary. Coverage/caps caveats are the same (capped flags +
enumeration limited to the co-admin's visible content). On failure returns
{"error": ...}.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| top | No | ||
| max_depth | No | ||
| max_events | No | ||
| max_folders | No | ||
| since_hours | No |