Imported from MustafaKemal0146/fetih (
skills/cybersecurity/soc-operations/detecting-insider-data-exfiltration-via-dlp/SKILL.md). Install upstream withnpx skills add MustafaKemal0146/fetih --skill detecting-insider-data-exfiltration-via-dlp. Copyright stays with the author.
Detection Insider Data Exfiltration via Dlp
Ne Zaman Kullanılır
- investigating yaparken security incidents that require Tespit etme insider data exfiltration via dlp
- building yaparken Tespit rules or threat hunting queries for this domain
- SOC yaparken: analysts need structured procedures for this analysis type
- validating yaparken security monitoring coverage for related attack techniques
Ön Gereksinimler
- Familiarity with security operations concepts and tools
- Erişim: a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
Instructions
Analyze endpoint activity logs, cloud storage access, and email DLP events to tespit etmedata exfiltration patterns using behavioral baselines and statistical anomaly Tespit.
import pandas as pd
df = pd.read_csv("file_activity.csv", parse_dates=["timestamp"])
baseline = df.groupby(["user", df["timestamp"].dt.date])["bytes_transferred"].sum()
user_avg = baseline.groupby("user").mean()
today = df[df["timestamp"].dt.date == pd.Timestamp.today().date()]
today_totals = today.groupby("user")["bytes_transferred"].sum()
anomalies = today_totals[today_totals > user_avg * 3]Key indicators:
- Upload volume exceeding 3x daily baseline
- Erişim: files outside normal scope
- Bulk downloads before resignation
- Off-hours file access patterns
- USB/external device usage spikes
Örnekler
df["hour"] = df["timestamp"].dt.hour
off_hours = df[(df["hour"] < 6) | (df["hour"] > 22)]
suspicious = off_hours.groupby("user").size().sort_values(ascending=False)