domains / families / security / performing-insider-threat-investigation

performing-insider-threat-investigation

separate

'Investigates insider threat incidents involving employees, contractors,

When to use

• DLP (Data Loss Prevention) alerts on large data transfers to personal cloud storage or USB devices
• User behavior analytics (UBA) detects anomalous access patterns for a user account
• HR reports a departing employee suspected of taking proprietary information
• A privileged user is observed accessing systems outside their job function
• Whistleblower or coworker report alleges policy violations or data theft

When not to use

• External attacker investigations where compromised credentials are used without insider collusion

Skill page

Source