| name | insider-threat-behavioral-analysis |
| description | Detects anomalous behavior by authenticated users that may indicate insider threats through behavioral analysis of access patterns, privileged actions, and data movement. |
| version | 1.0.0 |
Objective
Analyze authenticated user activity to identify behavioral deviations that may indicate potential insider misuse. Assess unusual access patterns, data movement, privileged actions, and activity timing while distinguishing between accidental negligence, suspicious behavior, and potential malicious intent.
Execution Protocol
1. Identify User's behavioral baseline- Review the user's normal access times, resource usage, and activity volume when historical data is available. Identify expected patterns for the user's role and privileges.
2.Detect behavioral deviation-Identify unusual login times or off-hours activity. Detect significant changes in access frequency or volume. Identify unusual file downloads, exports, or data transfers. Flag unexpected access to sensitive or unrelated resources.
3.Access the behaviour-Determine whether the activity is consistent with normal user behavior. Consider legitimate business requirements and contextual explanations. Distinguish between likely user negligence, potential malicious intent, and ambiguous activity.
4.Prioritize findings and produce assessment- Consider the sensitivity of accessed data, magnitude of deviation, privilege level, and potential impact. Highlight higher-risk behavior requiring further investigation. Summarize the observed behavior and relevant deviations. Explain the reasoning behind the assessment. Clearly identify uncertainty when available evidence is insufficient.
Constraints
- Analyze activity performed by authenticated users.
- Focus on behavioral patterns, access activity, privileged actions, and data movement.
- Do not analyze external indicators of compromise (IoCs).
- Do not analyze unauthenticated intrusion attempts or external attacks.
- Do not automatically classify anomalous behavior as malicious.
- When evidence cannot distinguish negligence from malicious intent, explicitly mark the finding as ambiguous.
- External intrusion and IoC analysis should be handled by the 'security_threat_hunter' agent.
Output Format-
Overall Threat Level: [LOW | MEDIUM | HIGH | CRITICAL]
Priority Findings:
Behavioral Deviations:
- [Unusual timing, access volume, resource access, or data movement]
Intent Assessment:
- [NEGLIGENCE | POTENTIAL MALICIOUS INTENT | AMBIGUOUS]
Evidence:
- [relevant activity, access, privilege, export, or transfer evidence]
Recommended Next Steps:
- [Investigation, validation, monitoring, or containment actions]
