Skip to main content
Solved

Reporting on/sharing Box Shield alerts?

  • October 21, 2026
  • 1 reply
  • 23 views
  • Translate All

Hello,

I’m looking for suggestions on how to best share the details of a Box Shield alert with an affected user.  For instance, if I want to share the details of an anomalous download alert with the user, including the list of folders.  There’s no way to report on it or export the alert, right?

Thanks in advance for any help!

Best answer by Jason S

Hi ​@RSKadish! 

There currently isn’t a dedicated report to export an anomalous download alert with its full folder and file breakdown. You can vote on the existing Box Pulse enhancement request and share how this would help your team.

As a workaround, you can run a User Activity Report:

  1. Go to Admin Console → Reports → Create Report → User Activity.

  2. Filter for the affected user and the activity date range shown in the Shield alert.

  3. Select the Downloaded action and include the Affected and Parent Folder columns to capture file names and folder paths.

  4. Export to CSV, review the results, and share the relevant details with the user.

For smaller alerts, sharing screenshots of the alert summary and expanded Anomalous Content Downloaded section is another option.

View original

1 reply

Jason S
Forum|alt.badge.img
  • Box Employee
  • Answer
  • October 21, 2026

Hi ​@RSKadish! 

There currently isn’t a dedicated report to export an anomalous download alert with its full folder and file breakdown. You can vote on the existing Box Pulse enhancement request and share how this would help your team.

As a workaround, you can run a User Activity Report:

  1. Go to Admin Console → Reports → Create Report → User Activity.

  2. Filter for the affected user and the activity date range shown in the Shield alert.

  3. Select the Downloaded action and include the Affected and Parent Folder columns to capture file names and folder paths.

  4. Export to CSV, review the results, and share the relevant details with the user.

For smaller alerts, sharing screenshots of the alert summary and expanded Anomalous Content Downloaded section is another option.

Translate