Data from Information Repositories: Confluence
- ID
- T1213.001
- Tactics
- TA0009 Collection
- Sub-technique of
- T1213 Data from Information Repositories
- Platforms
- SaaS
- Data sources
- Application Log Content, Logon Session Creation, Network Traffic Content
- Source
- attack.mitre.org
- MITRE last modified
- 3 Sep 2026
Adversaries may leverage Confluence repositories to mine valuable information.[1] Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation, however, in general may contain more diverse categories of useful information, such as:
- Policies, procedures, and standards
- Physical / logical network diagrams
- System architecture diagrams
- Technical system documentation
- Testing / development credentials (i.e., Unsecured Credentials)
- Work / project schedules
- Source code snippets
- Links to network shares and other internal resources
Detection
- DET0358 Programmatic and Excessive Access to Confluence Documentation
Data components: Application Log Content, Logon Session Creation, Network Traffic Content
Mitigations (3)
- M1017 User Training
Develop and publish policies that define acceptable information to be stored in Confluence repositories.
- M1018 User Account Management
Enforce the principle of least-privilege. Consider implementing access control mechanisms that include both authentication and authorization.
- M1047 Audit
Consider periodic review of accounts and privileges for critical and sensitive Confluence repositories.