The principal objective of this project is to develop a knowledge base of the tactics, techniques, and procedures (TTPs) used by insiders in the IT environment. It will establish an Insider Threat TTP Knowledge Base, built upon data collected on insider threat incidents and lessons learned and experience from the ATT&CK knowledge base.
An open framework for classifying, detecting, and preventing insider threat behaviors.
Pentastic is a UEBA-based insider threat detection system that uses behavioral analysis, risk scoring, and deception techniques to detect and prevent malicious user activity in real time.
Proxilion MCP Security Gateway is a self-hosted, Docker-ready security gateway that provides real-time threat detection (<50ms P95 latency) against insider threats, compromised accounts, and rogue AI agents by analyzing tool calls from assistants like Copilot and Claude Code, achieving a 75-85% detection rate against sophisticated attacks.
Fraud detection MCP server: Isolation Forest + Autoencoder ensemble, behavioral biometrics, agent-to-agent transaction protection, defense compliance (NITTF/SIEM/SEAD). 24 tools, 831 tests.
A curated technical resource for Insider Threat Management, Data Loss Prevention (DLP), and User Activity Monitoring (UAM).
Patent-aligned cybersecurity prototype implementing dynamic trust-based adaptive access control using credential integrity, competence evidence, behavioral risk, and event-driven trust recomputation.
🧠 Open-source UEBA that catches insider threats — behavioral baselines, ML anomaly detection & MITRE ATT&CK mapping. No enterprise license needed.
Top User & Entity Behavior Analytics (UEBA) 🌟 Star if you like it! 🌟
A digital immune system designed to detect and neutralize identity-based threats from within an organization
A Hybrid Approach for Insider Threat Detection Using System Call Analysis and Malware API Monitoring.
DFIR framework aligned to NIST SP 800-61, ISO/IEC 27037/27042 and FRE 702: forensic templates, playbooks, triage guides.
Public docs for Black Box by Alcyone Secure — a forensic flight recorder for Windows that keeps tamper-evident, hash-chained logs of what happens to a device in someone else's hands: repair shops, insider threats, device handovers. Complements EDR/DLP; aligned with DPDP Act 2023 & GDPR.
Top Insider Risk Management 🌟 Star if you like it! 🌟
SENTINEL is an immersive insider threat detection and training platform designed for security analysts, SOC teams, and IT professionals. Featuring a fully simulated UEBA (User and Entity Behavior Analytics) environment, interactive threat simulations, and comprehensive indicators of compromise (IOCs) library🔒👨🏿💻.
Benchmark for detecting insider threats by AI agents in a simulated frontier AI lab
Personal data analysis project combining insider threat detection, cybersecurity, and exploratory data analytics. Built for portfolio showcase and practical skills demonstration.
AI-aware DLP engine for semiconductor IP — multi-signal detection (regex, exact data match, document fingerprinting, ML classifier) fused by a policy engine into tiered responses, plus GenAI prompt guardrails and behavioral insider-risk analytics. Pure Python, zero dependencies.
Enterprise Microsoft Purview Audit implementation — unified audit log search, security investigation, insider threat detection, and compliance reporting across Microsoft 365.
To associate your repository with the insider-threat topic, visit your repo's landing page and select "manage topics."