The principal objective of this project is to develop a knowledge base of the tactics, techniques, and procedures (TTPs) used by insiders in the IT environment. It will establish an Insider Threat TTP Knowledge Base, built upon data collected on insider threat incidents and lessons learned and experience from the ATT&CK knowledge base.
An open framework for classifying, detecting, and preventing insider threat behaviors.
Pentastic is a UEBA-based insider threat detection system that uses behavioral analysis, risk scoring, and deception techniques to detect and prevent malicious user activity in real time.
Proxilion MCP Security Gateway is a self-hosted, Docker-ready security gateway that provides real-time threat detection (<50ms P95 latency) against insider threats, compromised accounts, and rogue AI agents by analyzing tool calls from assistants like Copilot and Claude Code, achieving a 75-85% detection rate against sophisticated attacks.
Fraud detection MCP server: Isolation Forest + Autoencoder ensemble, behavioral biometrics, agent-to-agent transaction protection, defense compliance (NITTF/SIEM/SEAD). 24 tools, 831 tests.
A curated technical resource for Insider Threat Management, Data Loss Prevention (DLP), and User Activity Monitoring (UAM).
Blue Team Insider Threat Breach Response and Incident Handling - A professional SOC + DFIR cybersecurity project simulating a real-world enterprise insider data breach investigation in a financial organization.
Patent-aligned cybersecurity prototype implementing dynamic trust-based adaptive access control using credential integrity, competence evidence, behavioral risk, and event-driven trust recomputation.
Multi-sensor Active Directory insider-threat detection & UBA platform with Windows Event Forwarding, read-only process lineage, and privacy-preserving browser telemetry
🧠 Open-source UEBA that catches insider threats — behavioral baselines, ML anomaly detection & MITRE ATT&CK mapping. No enterprise license needed.
Top User & Entity Behavior Analytics (UEBA) 🌟 Star if you like it! 🌟
A comprehensive Blue Team lab project for detecting and responding to insider threat breaches using Wazuh, Splunk, and ELK.
A digital immune system designed to detect and neutralize identity-based threats from within an organization
A Hybrid Approach for Insider Threat Detection Using System Call Analysis and Malware API Monitoring.
DFIR framework aligned to NIST SP 800-61, ISO/IEC 27037/27042 and FRE 702: forensic templates, playbooks, triage guides.
Enterprise-Grade AI/ML-Powered Insider Threat Detection Platform
Enterprise Microsoft Purview Audit implementation — unified audit log search, security investigation, insider threat detection, and compliance reporting across Microsoft 365.
Bowtie risk model analysis of insider data theft at Tesla - identifying crown jewel assets, mapping threat pathways, and evaluating preventive and mitigative security controls.
Top Insider Risk Management 🌟 Star if you like it! 🌟
To associate your repository with the insider-threat topic, visit your repo's landing page and select "manage topics."