The principal objective of this project is to develop a knowledge base of the tactics, techniques, and procedures (TTPs) used by insiders in the IT environment. It will establish an Insider Threat TTP Knowledge Base, built upon data collected on insider threat incidents and lessons learned and experience from the ATT&CK knowledge base.
An open framework for classifying, detecting, and preventing insider threat behaviors.
Pentastic is a UEBA-based insider threat detection system that uses behavioral analysis, risk scoring, and deception techniques to detect and prevent malicious user activity in real time.
Proxilion MCP Security Gateway is a self-hosted, Docker-ready security gateway that provides real-time threat detection (<50ms P95 latency) against insider threats, compromised accounts, and rogue AI agents by analyzing tool calls from assistants like Copilot and Claude Code, achieving a 75-85% detection rate against sophisticated attacks.
Fraud detection MCP server: Isolation Forest + Autoencoder ensemble, behavioral biometrics, agent-to-agent transaction protection, defense compliance (NITTF/SIEM/SEAD). 24 tools, 831 tests.
A curated technical resource for Insider Threat Management, Data Loss Prevention (DLP), and User Activity Monitoring (UAM).
Patent-aligned cybersecurity prototype implementing dynamic trust-based adaptive access control using credential integrity, competence evidence, behavioral risk, and event-driven trust recomputation.
🧠 Open-source UEBA that catches insider threats — behavioral baselines, ML anomaly detection & MITRE ATT&CK mapping. No enterprise license needed.
Top User & Entity Behavior Analytics (UEBA) 🌟 Star if you like it! 🌟
A digital immune system designed to detect and neutralize identity-based threats from within an organization
SENTINEL is an immersive insider threat detection and training platform designed for security analysts, SOC teams, and IT professionals. Featuring a fully simulated UEBA (User and Entity Behavior Analytics) environment, interactive threat simulations, and comprehensive indicators of compromise (IOCs) library🔒👨🏿💻.
Top Insider Risk Management 🌟 Star if you like it! 🌟
Public docs for Black Box by Alcyone Secure — a forensic flight recorder for Windows that keeps tamper-evident, hash-chained logs of what happens to a device in someone else's hands: repair shops, insider threats, device handovers. Complements EDR/DLP; aligned with DPDP Act 2023 & GDPR.
Blue Team Insider Threat Breach Response and Incident Handling - A professional SOC + DFIR cybersecurity project simulating a real-world enterprise insider data breach investigation in a financial organization.
Bowtie risk model analysis of insider data theft at Tesla - identifying crown jewel assets, mapping threat pathways, and evaluating preventive and mitigative security controls.
A Hybrid Approach for Insider Threat Detection Using System Call Analysis and Malware API Monitoring.
An open framework for classifying, detecting, and preventing synthetic insider threat behaviors.
Enterprise-Grade AI/ML-Powered Insider Threat Detection Platform
Enterprise Microsoft Purview Audit implementation — unified audit log search, security investigation, insider threat detection, and compliance reporting across Microsoft 365.
To associate your repository with the insider-threat topic, visit your repo's landing page and select "manage topics."