Box Integration | Exaforce

When a Box file is shared outside the company, Exaforce helps security teams determine how access was granted and whether anyone used it.

Overview

For teams working across offices and time zones, a shared Box folder gives employees, customers, and partners one place to work on a project. A team can invite a partner once and add documents as the work progresses. But a file added weeks later can inherit the folder’s original permissions, and someone can forward a shared link beyond the people the team intended to include.

That leaves security teams with two questions when a document may have been exposed. How did it become accessible, and did anyone use that access? Exaforce brings Box sharing settings and audit records together so analysts can trace access back to a folder, link, or collaborator role and check whether Box recorded a preview or download.

How it works

Exaforce links Box audit events to file ownership, sharing permissions, and collaborator roles so analysts can trace how an account gained access to a file. They can then follow that account’s activity across connected identity, endpoint, and cloud sources to assess whether a download was part of a broader incident.

Core capabilities

Trace a file’s sharing permissions

Identify the link, folder, or collaborator role that grants access. Distinguish files shared within the organization from those available to external collaborators or anyone with the link.

Review collaborator activity

Compare a collaborator’s assigned role with the actions Box recorded for that account. Check which files they previewed or downloaded and whether they changed how those files were shared.

Reconstruct a file’s history

See who uploaded, renamed, or copied a file and when. If the file is missing from a folder, check whether someone moved it to another folder or put it in the trash.

Benefits

Understand the scope of an incident

See how widely a file was shared and whether Box recorded anyone accessing it.

Follow activity across systems

Review Box events alongside sign-ins, endpoint activity, and cloud logs from connected sources to establish what happened before and after a file was accessed.

Spot potential account misuse

Flag Box activity from a known malicious IP or a location that’s unusual for the user.

FAQs

Which Box data does Exaforce use?

Box audit records cover sign-ins, file activity, changes to collaborators, and administrative actions. Exaforce also collects file and folder metadata, sharing settings, users and email aliases, group memberships, device pins, and enterprise settings. It collects enterprise metadata templates where the Box plan supports them.

Which Box API calls does Exaforce use?

For enterprise audit events, including sign-ins, previews, and downloads, Exaforce uses GET /2.0/events?stream_type=admin_logs. To collect file ownership, parent folders, and shared links, it lists folder contents with GET /2.0/folders/{folder_id}/items. To identify collaborator roles, it uses GET /2.0/files/{file_id}/collaborations for files and GET /2.0/folders/{folder_id}/collaborations for folders.

What do I need to connect Box?

A Box enterprise administrator must authorize the app. In Exaforce, select Box under Platform > Data Sources and enter the client ID, client secret, and Box enterprise ID. Supported plans include Business, Business Plus, Enterprise, Enterprise Plus, Enterprise Advanced, and the free developer plan. Collection counts toward the plan’s API allowance.