detecting-insider-threat-with-ueba
From the author
Implement User and Entity Behavior Analytics using Elasticsearch/OpenSearch to build behavioral baselines, calculate anomaly scores, perform peer group analysis, and detect insider threat indicators such as data exfiltration, privilege abuse, and unauthorized access patterns.
Install
npx skills add 26zl/cybersec-toolkit --skill detecting-insider-threat-with-ueba -a claude-code
Installs to .claude/skills/detecting-insider-threat-with-ueba/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
- Ships scripts we have not reviewedLow
Why 77
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- performing-user-behavior-analytics26zl/cybersec-toolkitPerforms User and Entity Behavior Analytics (UEBA) to detect anomalous user activities including impossible travel, unusual access patterns, privilege abuse, and insider threats using SIEM-based behavioral baselines and statistical analysis. Use when SOC teams need to identify compromised accounts or insider threats through deviation from established behavioral norms.Data★ 82
- detecting-insider-threat-behaviors26zl/cybersec-toolkitDetect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated data theft.Other★ 82
- detecting-service-account-abuse26zl/cybersec-toolkitDetect abuse of service accounts through anomalous interactive logons, privilege escalation, lateral movement, and unauthorized access patterns.Other★ 82
- detecting-data-anomaliesforyourhealth111-pixel/Vibe-SkillsInvestigate outliers, rare events, spikes, and suspicious records in datasets. Use as an explicit anomaly-analysis helper when you want concrete anomaly-detection workflow guidance, not generic data validation or end-to-end ML ownership.Finance★ 3.8K
- exploits-searchdavepoon/buildwithclaudeSearch for exploits across all vulnerabilities with filtering by ecosystem, severity, source, and EPSSSecurity★ 3.7K
- security-alert-triageelastic/agent-skillsTriage Elastic Security alerts — gather context, classify threats, create cases, and acknowledge. Use when triaging alerts, performing SOC analysis, or investigating detections.OfficialSecurity★ 600
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in