👤
Insider Threat
Malicious or negligent activity by an authorized user, employee, contractor, or business partner that compromises data or systems.
25 runbook nodes8 lifecycle stages covered
Triage
(3 nodes)Containment
(3 nodes)Preservation
(4 nodes)Collection
(5 nodes)EDR Telemetry Collection
P2EDR Collection
120min
View node
M365 Unified Audit Log Collection
P2M365 UAL Collection
90min
View node
Collect DLP Policy Alerts and Hits
P2DLP Alerts
45min
View node
Identify Alternative Evidence When Primary Logs Are Missing
P2Missing Log Fallback
60min
View node
Coordinate Log Collection from Third-Party Vendors
P3Third-Party Logs
120min
View node
Analysis
(4 nodes)Lateral Movement Analysis and Mapping
P1Lateral Movement
120min
View node
Map Exfiltration Channels (HTTP, DNS, Cloud Sync)
P1Exfil Channels
90min
View node
Analyze Evidence of Credential Dumping Techniques
P1Credential Dumping
90min
View node
Identify Data Staging and Compression Activity
P2Data Staging
60min
View node