👤 Insider Threat
Malicious or negligent activity by an authorized user, employee, contractor, or business partner that compromises data or systems.
25 procedures8 lifecycle stages
Triage
(3 procedures)Containment
(3 procedures)Credential and Account Lockdown
Account Lockdown
45min
View procedure
Block Active Exfiltration Pathways
Block Exfiltration
30min
View procedure
Covertly Restrict Insider Threat Actor Access
Insider Containment
45min
View procedure
Sponsored
Preservation
(4 procedures)Volatile Memory Capture
Memory Capture
60min
View procedure
Log Preservation and Snapshot
Log Snapshot
45min
View procedure
Document Chain of Custody for All Collected Evidence
Chain of Custody
30min
View procedure
Covert Evidence Capture for Insider Threat
Insider Evidence Capture
120min
View procedure
Collection
(5 procedures)EDR Telemetry Collection
EDR Collection
120min
View procedure
M365 Unified Audit Log Collection
M365 UAL Collection
90min
View procedure
Collect DLP Policy Alerts and Hits
DLP Alerts
45min
View procedure
Identify Alternative Evidence When Primary Logs Are Missing
Missing Log Fallback
60min
View procedure
Coordinate Log Collection from Third-Party Vendors
Third-Party Logs
120min
View procedure
Analysis
(4 procedures)Lateral Movement Analysis and Mapping
Lateral Movement
120min
View procedure
Map Exfiltration Channels (HTTP, DNS, Cloud Sync)
Exfil Channels
90min
View procedure
Analyze Evidence of Credential Dumping Techniques
Credential Dumping
90min
View procedure
Identify Data Staging and Compression Activity
Data Staging
60min
View procedure