👤 Insider Threat theater

Covers malicious, negligent and recruited insiders who abuse authorized access to exfiltrate data, sabotage systems or enable espionage. Combines behavioral, financial and technical signals to detect the threat that bypasses the perimeter entirely.

🏹 Threat Actors

🧭 Intelligence disciplines

📚 Priority sources & datasets

📜 Insider Threat Playbook

1. Collect access anomalies, mass-download and USB/cloud-egress events alongside HR risk indicators and dark-web insider-recruitment ads.
2. Correlate identity, endpoint DLP and badge/VPN logs to build per-user behavioral baselines and deviation timelines.
3. Analyze exfiltration staging, off-hours access and privilege escalation against known insider-kill-chain patterns.
4. Attribute intent by tying activity to financial stressors, foreign-contact HUMINT signals or ransomware-crew insider bounties.
5. Disseminate case packages to legal, HR and counterintelligence under strict need-to-know handling.
6. Trigger access revocation, forensic imaging and coordinated interview/containment while preserving chain of custody for prosecution.

⚡ AI Skills & Automation

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🎯 Add to case

🗃 Data Management

🧩 Advanced Capabilities

🔗 Cross-domain pivots