DeepSeek

1. 01DeepSeek trains on customer data. Block the app or move users to a business tier that excludes training.
2. 02140 MB left for DeepSeek through Splunk (demo) in 30 days. Check the proxy or firewall for file uploads and pair this with a DLP rule for AI destinations.
3. 03Splunk (demo) confirms what Microsoft 365 signals show for DeepSeek. Use the source list here to find the exact devices and network segments involved.

• ▲Critical75DeepSeekNetwork2 people
• ●Medium40DeepSeekEndpoint2 people
• ◆High70DeepSeek: sensitive dataPurview DLP2 people

Identifiers come from device telemetry and proxy logs, so they may be account names rather than full directory entries.

1. siem_traffic · Sep 12, 2026
   Splunk (demo): 220 events to chat.deepseek.com from 1 user and 1 source in 30 days, 140 MB uploaded
   Detail

   {
     "hosts": [
       {
         "host": "chat.deepseek.com",
         "events": 220,
         "bytesOut": 146800640
       }
     ],
     "bytesIn": 20971520,
     "bytesOut": 146800640,
     "topUsers": [
       {
         "user": "[email protected]",
         "events": 220
       }
     ],
     "topSources": [
       {
         "events": 220,
         "source": "10.20.4.90"
       }
     ]
   }

2. corroboration
   Also found by another lane (mdca:40311)
   Detail

   {
     "findingKey": "mdca:40311"
   }

3. corroboration
   Also found by another lane (dlp:deepseek)
   Detail

   {
     "findingKey": "dlp:deepseek"
   }

4. corroboration
   Also found by another lane (mde:deepseek)
   Detail

   {
     "findingKey": "mde:deepseek"
   }