Monitoring file sharing commands between network equipment to identify adverse conditions

Server equipment, comprising:

• at least one processor;
• and
• at least one memory that stores executable instructions that, when executed by the at least one processor, facilitate performance of operations, comprising:
• monitor resource sharing communication between first network equipment and second network equipment via a network;
• based on the resource sharing communication, determine an access activity pattern comprising at least one access command metric, resulting in a determined access activity pattern;
• determine that the at least one access command metric corresponds to the determined access activity pattern having at least a threshold likelihood of indicating a data leakage event based on a normal access activity pattern that comprises at least one normal access command metric;
• and
• in response to determining that the at least one access command metric has at least the threshold likelihood of indicating a data leakage event, cause a mitigation action to mitigate a potential effect of the data leakage event,
• wherein the resource sharing communication comprises at least one command from the first network equipment to access storage units stored by the second network equipment, and wherein the at least one command from the first network equipment to access storage units by the second network equipment comprises a connect command followed by a read command followed by a disconnect command, wherein the at least one access command metric of the determined access activity pattern comprises copying all files in a directory after the connect command and disconnecting after all of the files in the directory have been copied without other commands from the first network equipment to access storage units stored by the second network equipment occurring between the connect command and the disconnect command.

A non-transitory machine-readable medium, comprising executable instructions that, when executed by at least one processor of first network equipment, facilitate performance of operations, comprising:

• monitor resource sharing communication between second network equipment and third network equipment via a network;
• based on the resource sharing communication, determine an access activity pattern comprising an access command metric;
• determine that the access command metric corresponds to the access activity pattern having a threshold likelihood of indicating a data leakage event based on a normal access activity pattern that comprises a normal access command metric;
• and
• in response to determining that the access command metric has the threshold likelihood of indicating a data leakage event, initiate a mitigation action selected to mitigate the data leakage event,
• wherein the at least one access command metric corresponds to copying all files in at least one storage unit after a connect command and disconnecting after all of the files in the at least one storage unit have been copied without other commands to access the at least one storage unit occurring between the connect command and the disconnect command.