Structured playbook for SOC teams to detect, correlate, and document insider threat activity across DLP, endpoint, and HR data.
Skill explicitly requires authorization from HR, Legal, and Privacy before any monitoring begins.
Use npx skills add to install this skill into the selected agent. Phase 0 commands are generated from source rules, not verified.
npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills -g -a codex -yDrop `-g` to install project-locally
Open the product, try the flow, fix what breaks, repeat.
Open the app, test the flow, fix what breaks.
No fixes until the root cause is real.
| this skill · 当前Investigating Insider Threat Indicators | QA Loop | GStack QA | GStack Investigate | |
|---|---|---|---|---|
| Rating · 评分 | 0.0 | 4.9 | 4.8 | 4.8 |
| Stars · 星标 | 16k | 15k | 110k | 110k |
| Risk · 风险 | Automated screen · 自动筛查 | Medium risk · 中风险 | Medium risk · 中风险 | Low risk · 低风险 |
| Best for · 最适合 | Tier 2 SOC analysts handling insider threat referrals | Browser smoke tests | Open the app, test the flow, fix what breaks. | No fixes until the root cause is real. |
| Not for · 不适合 | External threat hunting without an authorized subject and scope | Pure unit testing | Workflows that require stronger human review than this catalog entry documents. | Workflows that require stronger human review than this catalog entry documents. |