Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Detecting Insider Threat with UEBA · mukul975 | DecimalAI

Detecting Insider Threat With Ueba

SkillScore27Maintained

detecting-insider-threat-with-ueba

Implement User and Entity Behavior Analytics using Elasticsearch/OpenSearch to build behavioral baselines, calculate anomaly scores, perform peer group analysis, and detect insider threat indicators such as data exfiltration, privilege abuse, and unauthorized access patterns.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/detecting-insider-threat-with-ueba/SKILL.md

decimalai skills pull detecting-insider-threat-with-ueba --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/detecting-insider-threat-with-ueba/SKILL.md https://app.decimal.ai/s/detecting-insider-threat-with-ueba/SKILL.md

Raw file: /s/detecting-insider-threat-with-ueba/SKILL.md ↗ · machine-readable summary at /s/detecting-insider-threat-with-ueba.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

Yes — +27% lift+2% tokens0% turns27% of whole cases pass with skill (6/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-12	✗→✓	▲ Improved	—	—
case-07	✗→✓	▲ Improved	—	—
case-09	✗→✓	▲ Improved	—	—
case-06	✗→✓	▲ Improved	—	—
case-13	✗→✓	▲ Improved	—	—

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/detecting-insider-threat-with-ueba/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 2 files · scripts

Skill contents

scripts/

references/

SKILL.md

Detecting Insider Threat with UEBA

Overview

User and Entity Behavior Analytics (UEBA) moves beyond static rule-based detection to model normal behavior for users, hosts, and applications, then flag statistically significant deviations that may indicate insider threats. Using Elasticsearch as the analytics backend, this skill covers building behavioral baselines from authentication logs, file access events, and network activity, computing risk scores using statistical deviation and peer group comparison, and correlating multiple low-confidence indicators into high-confidence insider threat alerts.

When to Use

When investigating security incidents that require detecting insider threat with ueba
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Elasticsearch 8.x or OpenSearch 2.x cluster with security audit data
Log sources: Active Directory authentication, VPN, DLP, file server access, email
Python 3.9+ with elasticsearch client library
Baseline period of 30+ days of normal user activity data
Defined peer groups based on department, role, or job function

Steps

Step 1: Ingest and Normalize Activity Logs

Configure log pipelines to ingest authentication, file access, email, and network logs into Elasticsearch with a unified user identity field.

Step 2: Build Behavioral Baselines

Calculate per-user baselines for login times, data volume, application usage, and access patterns over a rolling 30-day window using Elasticsearch aggregations.

Step 3: Calculate Anomaly Scores

Compare current activity against baselines using z-score deviation and peer group comparison to generate per-user risk scores.

Step 4: Correlate and Alert

Combine multiple anomalous indicators (unusual hours + large downloads + new system access) into composite risk scores that trigger SOC investigation workflows.

Expected Output

JSON report containing per-user risk scores, anomalous activity details, peer group deviations, and recommended investigation actions.

Illustrative Want to see what detecting-insider-threat-with-ueba would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 02:00 UTC · 22 cases

Lift

+27%

27% vs 0%

Agent turns

1.0 vs 1.0

Tokens

+2%

2,158.68 vs 2,108.23

fail → pass · 6fail → fail · 16

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-05 A user logged in at 3:00 AM, generating a low-confidence statistical anomaly score. The analyst wants to immediately dispatch an emergency SOC alert for this single event. How should low-confidence indicators like unusual hours, high download volumes, and new system access be handled before triggering high-confidence alerts?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 When analyzing user data exfiltration attempts against historical baselines in Elasticsearch, an engineer proposes flagging any user who transfers more than 5 GB in a single day using fixed byte limits. What statistical calculation method should be used instead of static volume thresholds to account for variance?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 Our threat intelligence feed provided file hashes and byte patterns for a ransomware strain to scan with YARA. How should we set up rolling 30-day Elasticsearch UEBA peer group aggregations to match these YARA malware patterns on disk?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 When comparing UEBA in Elasticsearch against traditional perimeter firewalls, how does UEBA fundamentally differ from static rule-based detection?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 In Elasticsearch UEBA baseline pipelines, how should behavioral baselines be maintained over time as user work patterns and schedules naturally evolve?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-11 In an Elasticsearch UEBA pipeline, SOC analysts are receiving hundreds of single-event alerts whenever an employee accesses a new network share. How should detection logic be restructured to reduce noise and generate actionable alerts?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 An engineer is reviewing an employee who accessed a sensitive database at 2:00 AM. They plan to compare this event only to the individual user's previous history. What additional baseline comparison should be performed to determine if this access is anomalous relative to colleagues?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 We are architecting a user behavioral analytics solution to compute statistical baselines and aggregations over 30 days of security logs. Which analytics backend cluster engine is suited for performing these aggregate queries?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-20 We need to write a Snort IDS signature to detect external CVE-2023-1234 buffer overflow attempts against our public Apache web servers. Should we configure 30-day user rolling baselines or z-score peer group scores for this signature?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 To build comprehensive user behavioral baselines for insider threat detection in Elasticsearch, what primary log sources beyond web proxy logs should be ingested into the analytics pipeline? List the core authentication and server access sources.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-06 We are building an automated reporting script for our Elasticsearch insider threat detection pipeline. What specific top-level JSON field name should be used in the structured report schema to represent the aggregated risk level calculated from multiple anomaly indicators?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-13 A devops team is provisioning execution environments for the Elasticsearch UEBA calculation scripts written in Python. What minimum Python runtime version is required?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-16 During Step 1 of setting up the UEBA pipeline, raw logs from Active Directory, VPN, and file servers are arriving in Elasticsearch. What key pipeline processing step must occur before baseline aggregation queries can run across log types?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 We are setting up behavioral baselines in Elasticsearch to detect anomalous insider activity. The team suggests using a 7-day rolling window to save storage and establish baselines quickly. How long should the baseline window be set for accurate user activity modeling?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 We are writing a Python script to query the analytics cluster aggregate indices for user baseline calculations. Which official Python client library package should be specified in requirements.txt?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 When defining log ingestion scope for an insider threat monitoring pipeline in Elasticsearch, what role do email logs play alongside VPN and file access logs?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 When ingesting Active Directory, VPN, DLP, and file server logs into Elasticsearch for insider threat analytics, different systems log identity in different formats (`DOMAIN\user`, `user@company.com`, `uid`). How should log ingestion pipelines handle user identities across these sources?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 When structuring the JSON report output for an insider threat evaluation, what specific object keys must be included under each user's report entry to record their aggregated risk and peer group variance?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-15 How should user peer groups be organized in Elasticsearch UEBA models to ensure statistical comparisons reflect expected job duties rather than random groupings?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 We are hardening Linux SSH servers by setting `PermitRootLogin no` and `PasswordAuthentication no` in `/etc/ssh/sshd_config` to prevent SSH brute force attacks. How should z-score peer group calculations be configured in sshd_config to enforce this setting?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 When building user behavioral baselines over a rolling window in Elasticsearch, what specific dimensions of user activity should be measured beyond simple request counts?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 When configuring composite risk score thresholds in an Elasticsearch UEBA detection pipeline, what minimum composite score threshold on a 0-100 scale indicates a high-confidence anomaly requiring immediate escalation?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +27 percentage points is the difference between those two pass rates over the 22 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 0%
Pass rate with the skill: 27.3%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 1
Skill version measured: v1
Run completed: 7/28/2026, 02:00 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run27

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 55 days ago

Other measured skills in the registry, with their headline benchmark lift.