# Source: https://docs.datadoghq.com/security/default_rules/def-000-25u.md

---
title: Feature returning private information abused by IP
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Feature returning private information
  abused by IP
---

# Feature returning private information abused by IP
Tactic:[TA0010-exfiltration](https://attack.mitre.org/tactics/TA0010)Technique:[T1567-exfiltration-over-web-service](https://attack.mitre.org/techniques/T1567) 
### Goal{% #goal %}

When working normally, your application may be returning personally identifiable information (PII) to users.Although this could be intended, that feature may be abused by an attacker to leak that PII.

This rule aims to detect when an attacker is trying to leak PII from your application based on the volume of requests coming from a single IP.

### Strategy{% #strategy %}

Correlate traces from routes known to return PII and gauge the usual number of requests performed by public IPs.

If an IP is seen significantly exceeding the normal rate, a `Low` signal will be generated.

### Triage and response{% #triage-and-response %}

1. Investigate the activity and validate that it is legitimate. You can review the PII identified by App & API Protection in the trace field `@api.security.fields.pii.res`.
1. Consider blocking the IP if the activity is suspicious.
1. Consider hardening the feature to make abuse more complicated (password/2FA check, rate limiting, captcha, and so on).
1. Depending on the severity of the leak, you may have to report the leak to the authorities or to the impacted users.