[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFGKY0Z6ANSF18J23RTPKR":3,"skill-same:01M6AFGKY0Z6ANSF18J23RTPKR":114},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":51,"linkOnly":52,"markdownContent":53,"markdownBody":54,"frontMatter":55,"refName":73,"commitSha":74,"skillDirectory":75,"forksCount":76,"repositoryHtmlUrl":77,"repositoryHomepageUrl":78,"ownerHtmlUrl":79,"ownerBlogUrl":80,"ownerDescription":81,"updatedAt":82,"install":83,"resources":96},"01M6AFGKY0Z6ANSF18J23RTPKR","investigating-insider-threat-indicators",null,"Investigates insider threat indicators including data exfiltration attempts, unauthorized access patterns, policy violations, and pre-departure behaviors using SIEM analytics, DLP alerts, and HR data correlation. Use when SOC teams receive insider threat referrals from HR, detect anomalous data movement by employees, or need to build investigation timelines for potential insider threats.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Finvestigating-insider-threat-indicators\u002FSKILL.md",[18,23,28],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",{"categoryNo":29,"categoryName":30,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000038","人力资源",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50],"investigating insider threat indicators","indicators","correlation","hr-correlation","investigation","t1566","t1078","dlp","insider-threat","UEBA","policy","data","data-exfiltration","exfiltration","soc","teams","analytics","siem","cybersecurity","2026-11-10 10:12:30",false,"---\nname: investigating-insider-threat-indicators\ndescription: 'Investigates insider threat indicators including data exfiltration attempts,\n  unauthorized access patterns, policy violations, and pre-departure behaviors using\n  SIEM analytics, DLP alerts, and HR data correlation. Use when SOC teams receive\n  insider threat referrals from HR, detect anomalous data movement by employees, or\n  need to build investigation timelines for potential insider threats.\n\n  '\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- soc\n- insider-threat\n- data-exfiltration\n- dlp\n- ueba\n- investigation\n- hr-correlation\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- RS.MA-01\n- DE.AE-06\nmitre_attack:\n- T1078\n- T1685.002\n- T1685.005\n- T1566\n- T1048\n---\n# Investigating Insider Threat Indicators\n\n## When to Use\n\nUse this skill when:\n- HR refers a departing employee for monitoring during their notice period\n- DLP alerts indicate bulk data downloads or transfers to personal storage\n- UEBA detects anomalous access patterns deviating significantly from peer baselines\n- Management reports concerns about an employee accessing sensitive data outside their role\n\n**Do not use** without proper legal authorization — insider threat investigations must be coordinated with HR, Legal, and Privacy teams before monitoring begins.\n\n## Prerequisites\n\n- Legal authorization and HR referral documenting investigation justification\n- SIEM with DLP, endpoint, email, proxy, and authentication log sources\n- Data Loss Prevention (DLP) system (Microsoft Purview, Symantec, Forcepoint) with policy alerts\n- Endpoint monitoring capability (EDR with USB\u002Fremovable media logging)\n- HR data feed providing employment status, notice dates, and access entitlements\n- Chain of custody procedures for evidence preservation\n\n## Workflow\n\n### Step 1: Establish Investigation Scope and Legal Authorization\n\nBefore any monitoring, ensure proper authorization:\n\n```\nINSIDER THREAT INVESTIGATION AUTHORIZATION\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nCase ID:           IT-2024-0089\nSubject:           [Employee Name] — [Department]\nAuthorized By:     [CISO \u002F General Counsel]\nReferral Source:   HR — Employee submitted resignation, 2-week notice\nJustification:     Employee has access to trade secrets and customer PII\nScope:             Email, file access, USB, cloud storage, printing\nDuration:          2024-03-15 to 2024-03-29 (notice period)\nPrivacy Review:    Completed — compliant with acceptable use policy\n```\n\n### Step 2: Build Activity Timeline from SIEM\n\nQuery comprehensive activity for the subject:\n\n```spl\nindex=* (user=\"jsmith\" OR src_user=\"jsmith\" OR sender=\"jsmith@company.com\"\n         OR SubjectUserName=\"jsmith\")\nearliest=\"2024-03-01\" latest=now\n| eval event_category = case(\n    sourcetype LIKE \"%dlp%\", \"DLP\",\n    sourcetype LIKE \"%proxy%\", \"Web Access\",\n    sourcetype LIKE \"%email%\", \"Email\",\n    sourcetype LIKE \"%WinEventLog%\", \"Endpoint\",\n    sourcetype LIKE \"%o365%\", \"Cloud\",\n    sourcetype LIKE \"%vpn%\", \"VPN\",\n    sourcetype LIKE \"%badge%\", \"Physical Access\",\n    1=1, sourcetype\n  )\n| stats count by event_category, sourcetype, _time\n| timechart span=1d count by event_category\n```\n\n### Step 3: Detect Data Exfiltration Indicators\n\n**Bulk File Downloads (SharePoint\u002FOneDrive):**\n\n```spl\nindex=o365 sourcetype=\"o365:management:activity\" Operation IN (\"FileDownloaded\", \"FileSynced\")\nUserId=\"jsmith@company.com\" earliest=-30d\n| stats count AS downloads, sum(eval(if(isnotnull(FileSize), FileSize, 0))) AS total_bytes,\n        dc(SourceFileName) AS unique_files\n  by UserId, SiteUrl, _time\n| bin _time span=1d\n| eval total_gb = round(total_bytes \u002F 1073741824, 2)\n| where downloads > 50 OR total_gb > 1\n| sort - total_gb\n```\n\n**USB\u002FRemovable Media Usage:**\n\n```spl\nindex=sysmon EventCode=1 Computer=\"WORKSTATION-JSMITH\"\n(CommandLine=\"*removable*\" OR CommandLine=\"*usb*\"\n OR Image=\"*\\\\xcopy*\" OR Image=\"*\\\\robocopy*\")\n| table _time, Computer, User, Image, CommandLine\n| append [\n    search index=endpoint sourcetype=\"endpoint:device_connect\"\n    user=\"jsmith\" device_type=\"removable\"\n    | table _time, user, device_name, device_serial, action\n  ]\n| sort _time\n```\n\n**Email-Based Exfiltration:**\n\n```spl\nindex=email sourcetype=\"o365:messageTrace\"\nSenderAddress=\"jsmith@company.com\"\n| eval is_external = if(match(RecipientAddress, \"@company\\.com$\"), 0, 1)\n| eval has_attachment = if(isnotnull(AttachmentName), 1, 0)\n| stats count AS total_emails,\n        sum(is_external) AS external_emails,\n        sum(has_attachment) AS with_attachments,\n        sum(eval(if(is_external=1 AND has_attachment=1, 1, 0))) AS external_with_attach,\n        sum(Size) AS total_size_bytes\n  by SenderAddress\n| eval external_attach_pct = round(external_with_attach \u002F total_emails * 100, 1)\n| eval total_size_mb = round(total_size_bytes \u002F 1048576, 1)\n```\n\n**Cloud Storage Upload Detection:**\n\n```spl\nindex=proxy user=\"jsmith\"\n(dest IN (\"*dropbox.com\", \"*drive.google.com\", \"*onedrive.live.com\",\n          \"*box.com\", \"*wetransfer.com\", \"*mega.nz\")\n OR category=\"cloud-storage\")\nhttp_method=POST\n| stats count AS uploads, sum(bytes_out) AS total_uploaded\n  by user, dest, category\n| eval uploaded_mb = round(total_uploaded \u002F 1048576, 1)\n| sort - uploaded_mb\n```\n\n### Step 4: Analyze Access Pattern Anomalies\n\n**Accessing Sensitive Systems Outside Normal Scope:**\n\n```spl\nindex=auth user=\"jsmith\" action=success earliest=-30d\n| stats dc(app) AS unique_apps, values(app) AS apps_accessed by user\n| join user type=left [\n    | inputlookup role_app_mapping.csv\n    | search role=\"Financial Analyst\"\n    | stats values(authorized_app) AS authorized_apps by role\n    | eval user=\"jsmith\"\n  ]\n| eval unauthorized = mvfilter(NOT match(apps_accessed, mvjoin(authorized_apps, \"|\")))\n| where isnotnull(unauthorized)\n| table user, unauthorized, authorized_apps\n```\n\n**After-Hours and Weekend Activity:**\n\n```spl\nindex=* user=\"jsmith\" earliest=-30d\n| eval hour = tonumber(strftime(_time, \"%H\"))\n| eval is_offhours = if(hour \u003C 7 OR hour > 19, 1, 0)\n| eval day = strftime(_time, \"%A\")\n| eval is_weekend = if(day IN (\"Saturday\", \"Sunday\"), 1, 0)\n| stats count AS total, sum(is_offhours) AS offhours, sum(is_weekend) AS weekend by user\n| eval offhours_pct = round(offhours \u002F total * 100, 1)\n| eval weekend_pct = round(weekend \u002F total * 100, 1)\n```\n\n### Step 5: Correlate with HR and Physical Security Data\n\n**Compare activity to resignation timeline:**\n\n```spl\n| makeresults\n| eval user=\"jsmith\",\n       resignation_date=\"2024-03-15\",\n       last_day=\"2024-03-29\",\n       access_revocation=\"2024-03-29 17:00\"\n| join user [\n    search index=* user=\"jsmith\" earliest=-90d\n    | bin _time span=1d\n    | stats count AS daily_events, dc(sourcetype) AS data_sources by user, _time\n  ]\n| eval phase = case(\n    _time \u003C relative_time(now(), \"-30d\"), \"Normal (Pre-Resignation)\",\n    _time >= strptime(resignation_date, \"%Y-%m-%d\") AND _time \u003C= strptime(last_day, \"%Y-%m-%d\"),\n      \"Notice Period\",\n    1=1, \"Transition\"\n  )\n| chart avg(daily_events) AS avg_events by phase\n```\n\n**Badge\u002FPhysical Access Correlation:**\n\n```spl\nindex=badge_access employee_id=\"jsmith\" earliest=-30d\n| stats count AS badge_events, values(door_name) AS doors_accessed,\n        earliest(_time) AS first_badge, latest(_time) AS last_badge by employee_id\n| eval areas = mvcount(doors_accessed)\n```\n\n### Step 6: Preserve Evidence and Document Findings\n\nMaintain chain of custody for all collected evidence:\n\n```python\nimport hashlib\nimport json\nfrom datetime import datetime\n\nevidence_log = {\n    \"case_id\": \"IT-2024-0089\",\n    \"investigator\": \"soc_analyst_tier2\",\n    \"collection_time\": datetime.utcnow().isoformat(),\n    \"items\": [\n        {\n            \"item_id\": \"EV-001\",\n            \"description\": \"Splunk export — all user activity 2024-03-01 to 2024-03-15\",\n            \"file\": \"jsmith_activity_export.csv\",\n            \"sha256\": hashlib.sha256(open(\"jsmith_activity_export.csv\", \"rb\").read()).hexdigest(),\n            \"collected_by\": \"analyst_doe\",\n            \"collection_method\": \"Splunk search export\"\n        },\n        {\n            \"item_id\": \"EV-002\",\n            \"description\": \"DLP alert details — 47 policy violations\",\n            \"file\": \"dlp_alerts_jsmith.json\",\n            \"sha256\": hashlib.sha256(open(\"dlp_alerts_jsmith.json\", \"rb\").read()).hexdigest(),\n            \"collected_by\": \"analyst_doe\",\n            \"collection_method\": \"Microsoft Purview export\"\n        }\n    ]\n}\n\nwith open(f\"evidence_log_{evidence_log['case_id']}.json\", \"w\") as f:\n    json.dump(evidence_log, f, indent=2)\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Insider Threat** | Risk posed by individuals with legitimate access who misuse it for unauthorized purposes |\n| **Data Exfiltration** | Unauthorized transfer of data outside the organization via email, USB, cloud, or other channels |\n| **DLP** | Data Loss Prevention — technology monitoring and blocking unauthorized data transfers based on content policies |\n| **Notice Period Monitoring** | Enhanced surveillance of departing employees during their resignation-to-departure window |\n| **Chain of Custody** | Documented evidence handling procedures ensuring forensic integrity for potential legal proceedings |\n| **Need-to-Know Violation** | Accessing information or systems beyond what is required for an employee's role or current tasks |\n\n## Tools & Systems\n\n- **Microsoft Purview (formerly DLP)**: Data classification and loss prevention platform monitoring endpoints, email, and cloud storage\n- **Splunk UBA**: User behavior analytics detecting insider threat patterns through ML-based anomaly detection\n- **Forcepoint Insider Threat**: Dedicated insider threat detection platform with behavioral indicators and risk scoring\n- **DTEX InTERCEPT**: Endpoint-based insider threat detection focusing on user activity metadata collection\n- **Code42 Incydr**: Data risk detection platform specializing in file exfiltration monitoring across endpoints and cloud\n\n## Common Scenarios\n\n- **Departing Employee**: Bulk download of customer lists and product roadmaps during two-week notice period\n- **Disgruntled Employee**: After negative performance review, employee accesses executive salary data outside their role\n- **Contractor Overreach**: External consultant accessing systems beyond contracted scope, downloading source code\n- **Account Misuse**: Employee sharing credentials with unauthorized third party for competitive intelligence\n- **Sabotage Indicator**: IT admin creating backdoor accounts and modifying system configurations before departure\n\n## Output Format\n\n```\nINSIDER THREAT INVESTIGATION REPORT — IT-2024-0089\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nSubject:      jsmith (Financial Analyst, Finance Dept)\nPeriod:       2024-03-01 to 2024-03-15\nStatus:       Employee resigned 2024-03-15, last day 2024-03-29\n\nKey Findings:\n  [HIGH]  3,847 files downloaded from SharePoint (12.4 GB) — 10x peer average\n  [HIGH]  USB device connected 14 times during notice period (0 times prior month)\n  [HIGH]  187 emails with attachments sent to personal Gmail\n  [MEDIUM] After-hours activity increased 340% during notice period\n  [MEDIUM] Accessed HR salary database 3 times (not authorized for role)\n\nTimeline:\n  Mar 01-14:  Normal activity baseline (avg 150 events\u002Fday)\n  Mar 15:     Resignation submitted (activity spike to 890 events)\n  Mar 16-17:  Weekend access — 2,100 SharePoint downloads\n  Mar 18:     USB device first connected, DLP alert triggered\n\nEvidence Collected:   4 items (SHA-256 verified, chain of custody documented)\nRecommendation:       Immediate access revocation recommended\n                      Evidence package prepared for Legal review\n```\n","# Investigating Insider Threat Indicators\n\n## When to Use\n\nUse this skill when:\n- HR refers a departing employee for monitoring during their notice period\n- DLP alerts indicate bulk data downloads or transfers to personal storage\n- UEBA detects anomalous access patterns deviating significantly from peer baselines\n- Management reports concerns about an employee accessing sensitive data outside their role\n\n**Do not use** without proper legal authorization — insider threat investigations must be coordinated with HR, Legal, and Privacy teams before monitoring begins.\n\n## Prerequisites\n\n- Legal authorization and HR referral documenting investigation justification\n- SIEM with DLP, endpoint, email, proxy, and authentication log sources\n- Data Loss Prevention (DLP) system (Microsoft Purview, Symantec, Forcepoint) with policy alerts\n- Endpoint monitoring capability (EDR with USB\u002Fremovable media logging)\n- HR data feed providing employment status, notice dates, and access entitlements\n- Chain of custody procedures for evidence preservation\n\n## Workflow\n\n### Step 1: Establish Investigation Scope and Legal Authorization\n\nBefore any monitoring, ensure proper authorization:\n\n```\nINSIDER THREAT INVESTIGATION AUTHORIZATION\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nCase ID:           IT-2024-0089\nSubject:           [Employee Name] — [Department]\nAuthorized By:     [CISO \u002F General Counsel]\nReferral Source:   HR — Employee submitted resignation, 2-week notice\nJustification:     Employee has access to trade secrets and customer PII\nScope:             Email, file access, USB, cloud storage, printing\nDuration:          2024-03-15 to 2024-03-29 (notice period)\nPrivacy Review:    Completed — compliant with acceptable use policy\n```\n\n### Step 2: Build Activity Timeline from SIEM\n\nQuery comprehensive activity for the subject:\n\n```spl\nindex=* (user=\"jsmith\" OR src_user=\"jsmith\" OR sender=\"jsmith@company.com\"\n         OR SubjectUserName=\"jsmith\")\nearliest=\"2024-03-01\" latest=now\n| eval event_category = case(\n    sourcetype LIKE \"%dlp%\", \"DLP\",\n    sourcetype LIKE \"%proxy%\", \"Web Access\",\n    sourcetype LIKE \"%email%\", \"Email\",\n    sourcetype LIKE \"%WinEventLog%\", \"Endpoint\",\n    sourcetype LIKE \"%o365%\", \"Cloud\",\n    sourcetype LIKE \"%vpn%\", \"VPN\",\n    sourcetype LIKE \"%badge%\", \"Physical Access\",\n    1=1, sourcetype\n  )\n| stats count by event_category, sourcetype, _time\n| timechart span=1d count by event_category\n```\n\n### Step 3: Detect Data Exfiltration Indicators\n\n**Bulk File Downloads (SharePoint\u002FOneDrive):**\n\n```spl\nindex=o365 sourcetype=\"o365:management:activity\" Operation IN (\"FileDownloaded\", \"FileSynced\")\nUserId=\"jsmith@company.com\" earliest=-30d\n| stats count AS downloads, sum(eval(if(isnotnull(FileSize), FileSize, 0))) AS total_bytes,\n        dc(SourceFileName) AS unique_files\n  by UserId, SiteUrl, _time\n| bin _time span=1d\n| eval total_gb = round(total_bytes \u002F 1073741824, 2)\n| where downloads > 50 OR total_gb > 1\n| sort - total_gb\n```\n\n**USB\u002FRemovable Media Usage:**\n\n```spl\nindex=sysmon EventCode=1 Computer=\"WORKSTATION-JSMITH\"\n(CommandLine=\"*removable*\" OR CommandLine=\"*usb*\"\n OR Image=\"*\\\\xcopy*\" OR Image=\"*\\\\robocopy*\")\n| table _time, Computer, User, Image, CommandLine\n| append [\n    search index=endpoint sourcetype=\"endpoint:device_connect\"\n    user=\"jsmith\" device_type=\"removable\"\n    | table _time, user, device_name, device_serial, action\n  ]\n| sort _time\n```\n\n**Email-Based Exfiltration:**\n\n```spl\nindex=email sourcetype=\"o365:messageTrace\"\nSenderAddress=\"jsmith@company.com\"\n| eval is_external = if(match(RecipientAddress, \"@company\\.com$\"), 0, 1)\n| eval has_attachment = if(isnotnull(AttachmentName), 1, 0)\n| stats count AS total_emails,\n        sum(is_external) AS external_emails,\n        sum(has_attachment) AS with_attachments,\n        sum(eval(if(is_external=1 AND has_attachment=1, 1, 0))) AS external_with_attach,\n        sum(Size) AS total_size_bytes\n  by SenderAddress\n| eval external_attach_pct = round(external_with_attach \u002F total_emails * 100, 1)\n| eval total_size_mb = round(total_size_bytes \u002F 1048576, 1)\n```\n\n**Cloud Storage Upload Detection:**\n\n```spl\nindex=proxy user=\"jsmith\"\n(dest IN (\"*dropbox.com\", \"*drive.google.com\", \"*onedrive.live.com\",\n          \"*box.com\", \"*wetransfer.com\", \"*mega.nz\")\n OR category=\"cloud-storage\")\nhttp_method=POST\n| stats count AS uploads, sum(bytes_out) AS total_uploaded\n  by user, dest, category\n| eval uploaded_mb = round(total_uploaded \u002F 1048576, 1)\n| sort - uploaded_mb\n```\n\n### Step 4: Analyze Access Pattern Anomalies\n\n**Accessing Sensitive Systems Outside Normal Scope:**\n\n```spl\nindex=auth user=\"jsmith\" action=success earliest=-30d\n| stats dc(app) AS unique_apps, values(app) AS apps_accessed by user\n| join user type=left [\n    | inputlookup role_app_mapping.csv\n    | search role=\"Financial Analyst\"\n    | stats values(authorized_app) AS authorized_apps by role\n    | eval user=\"jsmith\"\n  ]\n| eval unauthorized = mvfilter(NOT match(apps_accessed, mvjoin(authorized_apps, \"|\")))\n| where isnotnull(unauthorized)\n| table user, unauthorized, authorized_apps\n```\n\n**After-Hours and Weekend Activity:**\n\n```spl\nindex=* user=\"jsmith\" earliest=-30d\n| eval hour = tonumber(strftime(_time, \"%H\"))\n| eval is_offhours = if(hour \u003C 7 OR hour > 19, 1, 0)\n| eval day = strftime(_time, \"%A\")\n| eval is_weekend = if(day IN (\"Saturday\", \"Sunday\"), 1, 0)\n| stats count AS total, sum(is_offhours) AS offhours, sum(is_weekend) AS weekend by user\n| eval offhours_pct = round(offhours \u002F total * 100, 1)\n| eval weekend_pct = round(weekend \u002F total * 100, 1)\n```\n\n### Step 5: Correlate with HR and Physical Security Data\n\n**Compare activity to resignation timeline:**\n\n```spl\n| makeresults\n| eval user=\"jsmith\",\n       resignation_date=\"2024-03-15\",\n       last_day=\"2024-03-29\",\n       access_revocation=\"2024-03-29 17:00\"\n| join user [\n    search index=* user=\"jsmith\" earliest=-90d\n    | bin _time span=1d\n    | stats count AS daily_events, dc(sourcetype) AS data_sources by user, _time\n  ]\n| eval phase = case(\n    _time \u003C relative_time(now(), \"-30d\"), \"Normal (Pre-Resignation)\",\n    _time >= strptime(resignation_date, \"%Y-%m-%d\") AND _time \u003C= strptime(last_day, \"%Y-%m-%d\"),\n      \"Notice Period\",\n    1=1, \"Transition\"\n  )\n| chart avg(daily_events) AS avg_events by phase\n```\n\n**Badge\u002FPhysical Access Correlation:**\n\n```spl\nindex=badge_access employee_id=\"jsmith\" earliest=-30d\n| stats count AS badge_events, values(door_name) AS doors_accessed,\n        earliest(_time) AS first_badge, latest(_time) AS last_badge by employee_id\n| eval areas = mvcount(doors_accessed)\n```\n\n### Step 6: Preserve Evidence and Document Findings\n\nMaintain chain of custody for all collected evidence:\n\n```python\nimport hashlib\nimport json\nfrom datetime import datetime\n\nevidence_log = {\n    \"case_id\": \"IT-2024-0089\",\n    \"investigator\": \"soc_analyst_tier2\",\n    \"collection_time\": datetime.utcnow().isoformat(),\n    \"items\": [\n        {\n            \"item_id\": \"EV-001\",\n            \"description\": \"Splunk export — all user activity 2024-03-01 to 2024-03-15\",\n            \"file\": \"jsmith_activity_export.csv\",\n            \"sha256\": hashlib.sha256(open(\"jsmith_activity_export.csv\", \"rb\").read()).hexdigest(),\n            \"collected_by\": \"analyst_doe\",\n            \"collection_method\": \"Splunk search export\"\n        },\n        {\n            \"item_id\": \"EV-002\",\n            \"description\": \"DLP alert details — 47 policy violations\",\n            \"file\": \"dlp_alerts_jsmith.json\",\n            \"sha256\": hashlib.sha256(open(\"dlp_alerts_jsmith.json\", \"rb\").read()).hexdigest(),\n            \"collected_by\": \"analyst_doe\",\n            \"collection_method\": \"Microsoft Purview export\"\n        }\n    ]\n}\n\nwith open(f\"evidence_log_{evidence_log['case_id']}.json\", \"w\") as f:\n    json.dump(evidence_log, f, indent=2)\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Insider Threat** | Risk posed by individuals with legitimate access who misuse it for unauthorized purposes |\n| **Data Exfiltration** | Unauthorized transfer of data outside the organization via email, USB, cloud, or other channels |\n| **DLP** | Data Loss Prevention — technology monitoring and blocking unauthorized data transfers based on content policies |\n| **Notice Period Monitoring** | Enhanced surveillance of departing employees during their resignation-to-departure window |\n| **Chain of Custody** | Documented evidence handling procedures ensuring forensic integrity for potential legal proceedings |\n| **Need-to-Know Violation** | Accessing information or systems beyond what is required for an employee's role or current tasks |\n\n## Tools & Systems\n\n- **Microsoft Purview (formerly DLP)**: Data classification and loss prevention platform monitoring endpoints, email, and cloud storage\n- **Splunk UBA**: User behavior analytics detecting insider threat patterns through ML-based anomaly detection\n- **Forcepoint Insider Threat**: Dedicated insider threat detection platform with behavioral indicators and risk scoring\n- **DTEX InTERCEPT**: Endpoint-based insider threat detection focusing on user activity metadata collection\n- **Code42 Incydr**: Data risk detection platform specializing in file exfiltration monitoring across endpoints and cloud\n\n## Common Scenarios\n\n- **Departing Employee**: Bulk download of customer lists and product roadmaps during two-week notice period\n- **Disgruntled Employee**: After negative performance review, employee accesses executive salary data outside their role\n- **Contractor Overreach**: External consultant accessing systems beyond contracted scope, downloading source code\n- **Account Misuse**: Employee sharing credentials with unauthorized third party for competitive intelligence\n- **Sabotage Indicator**: IT admin creating backdoor accounts and modifying system configurations before departure\n\n## Output Format\n\n```\nINSIDER THREAT INVESTIGATION REPORT — IT-2024-0089\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nSubject:      jsmith (Financial Analyst, Finance Dept)\nPeriod:       2024-03-01 to 2024-03-15\nStatus:       Employee resigned 2024-03-15, last day 2024-03-29\n\nKey Findings:\n  [HIGH]  3,847 files downloaded from SharePoint (12.4 GB) — 10x peer average\n  [HIGH]  USB device connected 14 times during notice period (0 times prior month)\n  [HIGH]  187 emails with attachments sent to personal Gmail\n  [MEDIUM] After-hours activity increased 340% during notice period\n  [MEDIUM] Accessed HR salary database 3 times (not authorized for role)\n\nTimeline:\n  Mar 01-14:  Normal activity baseline (avg 150 events\u002Fday)\n  Mar 15:     Resignation submitted (activity spike to 890 events)\n  Mar 16-17:  Weekend access — 2,100 SharePoint downloads\n  Mar 18:     USB device first connected, DLP alert triggered\n\nEvidence Collected:   4 items (SHA-256 verified, chain of custody documented)\nRecommendation:       Immediate access revocation recommended\n                      Evidence package prepared for Legal review\n```\n",{"name":5,"tags":56,"author":58,"domain":50,"license":15,"version":59,"nist_csf":60,"subdomain":65,"description":66,"mitre_attack":67},[46,40,44,39,57,36,35],"ueba","mahipal","1.0",[61,62,63,64],"DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06","soc-operations","Investigates insider threat indicators including data exfiltration attempts, unauthorized access patterns, policy violations, and pre-departure behaviors using SIEM analytics, DLP alerts, and HR data correlation. Use when SOC teams receive insider threat referrals from HR, detect anomalous data movement by employees, or need to build investigation timelines for potential insider threats.\n",[68,69,70,71,72],"T1078","T1685.002","T1685.005","T1566","T1048","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Finvestigating-insider-threat-indicators",4384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":84,"prompt":94,"zipAvailable":95},[85,88,91],{"tool":86,"command":87},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill investigating-insider-threat-indicators",{"tool":89,"command":90},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill investigating-insider-threat-indicators",{"tool":92,"command":93},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill investigating-insider-threat-indicators","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Finvestigating-insider-threat-indicators\u002FSKILL.md",true,[97,102,108],{"path":98,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Finvestigating-insider-threat-indicators\u002FLICENSE",{"path":103,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":106,"sourceHtmlUrl":107},"references\u002Fapi-reference.md","REFERENCE","参考文档",2475,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Finvestigating-insider-threat-indicators\u002Freferences\u002Fapi-reference.md",{"path":109,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":112,"sourceHtmlUrl":113},"scripts\u002Fagent.py","SCRIPT","脚本",8953,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Finvestigating-insider-threat-indicators\u002Fscripts\u002Fagent.py",[115,142,165,192,217,244],{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":122,"publishedAt":51},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[121],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[123,124,125,126,127,50,128,129,130,131,132,133,134,135,136,137,138,139,140,141],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":149,"publishedAt":51},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[148],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[150,138,151,152,127,42,50,130,153,154,155,156,157,158,159,160,161,162,163,164],"boot","TPM","validating tpm measured boot attestation","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":175,"publishedAt":51},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[171,174],{"categoryNo":172,"categoryName":173,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[159,176,177,178,179,50,180,181,153,182,183,184,185,186,187,38,188,189,190,191],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":193,"name":194,"nameZh":6,"description":195,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":196,"categories":197,"keywords":199,"publishedAt":51},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[198],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[200,201,202,50,203,204,205,206,207,208,209,43,210,211,212,213,156,214,215,216],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":218,"name":219,"nameZh":6,"description":220,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":221,"categories":222,"keywords":224,"publishedAt":51},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[223],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[225,226,227,50,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":245,"name":246,"nameZh":6,"description":247,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":248,"categories":249,"keywords":251,"publishedAt":51},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[250],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[127,252,50,49,253,254,46,255,256,257,258,38,259,188,260,261,262,263,264,265],"triaging security incident","file","ioc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]