Insider Threat

Malicious or negligent activity by an authorized user, employee, contractor, or business partner that compromises data or systems.

Triage

5 procedures

Bound the Investigation Timeframe

Identify Patient Zero (First Compromised System)

Validate Insider-Threat Tip and Choose Investigation Posture

Validate the Initial Access Vector

Establish 90-Day Behavioral Baseline for Subject

Containment

3 procedures

Credential and Account Lockdown

Block Active Exfiltration Pathways

Covertly Restrict Insider Threat Actor Access

Sponsored

Preservation

4 procedures

Volatile Memory Capture

Log Preservation and Snapshot

Document Chain of Custody for All Collected Evidence

Covert Evidence Capture for Insider Threat

Collection

5 procedures

EDR Telemetry Collection

M365 Unified Audit Log Collection

Collect DLP Policy Alerts and Hits

Identify Alternative Evidence When Primary Logs Are Missing

Coordinate Log Collection from Third-Party Vendors

Analysis

5 procedures

Lateral Movement Analysis and Mapping

Map Exfiltration Channels (HTTP, DNS, Cloud Sync)

Analyze Evidence of Credential Dumping Techniques

Identify Data Staging and Compression Activity

Identify Data Staging and Pre-Exfiltration Patterns

Eradication

2 procedures

Eradication Verification Checklist

Post-Incident Configuration Hardening

Recovery

1 procedure

Phased Service Restoration with Enhanced Monitoring

Post-Incident Review

5 procedures

Create New Detection Rules Based on Incident Findings

Generate Comprehensive Incident Report

Review Data Disclosure and Notification Decision Evidence

Insider-Control Lifecycle Review

Conduct Lessons Learned Review Session