[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M78MCVVWP8SWPVB0GPEGY7T6":3,"skill-same:01M78MCVVWP8SWPVB0GPEGY7T6":74},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":35,"commitSha":36,"skillDirectory":37,"forksCount":38,"repositoryHtmlUrl":39,"repositoryHomepageUrl":6,"ownerHtmlUrl":40,"ownerBlogUrl":41,"ownerDescription":42,"updatedAt":43,"install":44,"resources":57},"01M78MCVVWP8SWPVB0GPEGY7T6","detecting-insider-data-exfiltration-via-dlp",null,"Detects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload volume anomalies, and off-hours activity in endpoint and cloud logs. Uses pandas for behavioral analytics and statistical baselines. Use when investigating insider threats or building user behavior analytics for data loss prevention.","jukeyman\u002Fjukeyman-skills","jukeyman","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F142960420?v=4","01M78FR4Y3DHMMCBCC0GXXNB3F","RICK JEFFERSON","01M78FR4Z8RVQRAD31Y5J7V6EB",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-insider-data-exfiltration-via-dlp\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-insider-data-exfiltration-via-dlp\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: detecting-insider-data-exfiltration-via-dlp\ndescription: >\n  Detects insider data exfiltration by analyzing DLP policy violations, file access\n  patterns, upload volume anomalies, and off-hours activity in endpoint and cloud logs.\n  Uses pandas for behavioral analytics and statistical baselines. Use when investigating\n  insider threats or building user behavior analytics for data loss prevention.\ndomain: cybersecurity\nsubdomain: security-operations\ntags: [detecting, insider, data, exfiltration]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n\n# Detecting Insider Data Exfiltration via DLP\n\n\n## When to Use\n\n- When investigating security incidents that require detecting insider data exfiltration via dlp\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Familiarity with security operations concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Instructions\n\nAnalyze endpoint activity logs, cloud storage access, and email DLP events to detect\ndata exfiltration patterns using behavioral baselines and statistical anomaly detection.\n\n```python\nimport pandas as pd\n\ndf = pd.read_csv(\"file_activity.csv\", parse_dates=[\"timestamp\"])\n# Baseline: average daily upload volume per user\nbaseline = df.groupby([\"user\", df[\"timestamp\"].dt.date])[\"bytes_transferred\"].sum()\nuser_avg = baseline.groupby(\"user\").mean()\n\n# Alert on users exceeding 3x their baseline\ntoday = df[df[\"timestamp\"].dt.date == pd.Timestamp.today().date()]\ntoday_totals = today.groupby(\"user\")[\"bytes_transferred\"].sum()\nanomalies = today_totals[today_totals > user_avg * 3]\n```\n\nKey indicators:\n1. Upload volume exceeding 3x daily baseline\n2. Access to files outside normal scope\n3. Bulk downloads before resignation\n4. Off-hours file access patterns\n5. USB\u002Fexternal device usage spikes\n\n## Examples\n\n```python\n# Detect off-hours activity\ndf[\"hour\"] = df[\"timestamp\"].dt.hour\noff_hours = df[(df[\"hour\"] \u003C 6) | (df[\"hour\"] > 22)]\nsuspicious = off_hours.groupby(\"user\").size().sort_values(ascending=False)\n```\n","# Detecting Insider Data Exfiltration via DLP\n\n\n## When to Use\n\n- When investigating security incidents that require detecting insider data exfiltration via dlp\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Familiarity with security operations concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Instructions\n\nAnalyze endpoint activity logs, cloud storage access, and email DLP events to detect\ndata exfiltration patterns using behavioral baselines and statistical anomaly detection.\n\n```python\nimport pandas as pd\n\ndf = pd.read_csv(\"file_activity.csv\", parse_dates=[\"timestamp\"])\n# Baseline: average daily upload volume per user\nbaseline = df.groupby([\"user\", df[\"timestamp\"].dt.date])[\"bytes_transferred\"].sum()\nuser_avg = baseline.groupby(\"user\").mean()\n\n# Alert on users exceeding 3x their baseline\ntoday = df[df[\"timestamp\"].dt.date == pd.Timestamp.today().date()]\ntoday_totals = today.groupby(\"user\")[\"bytes_transferred\"].sum()\nanomalies = today_totals[today_totals > user_avg * 3]\n```\n\nKey indicators:\n1. Upload volume exceeding 3x daily baseline\n2. Access to files outside normal scope\n3. Bulk downloads before resignation\n4. Off-hours file access patterns\n5. USB\u002Fexternal device usage spikes\n\n## Examples\n\n```python\n# Detect off-hours activity\ndf[\"hour\"] = df[\"timestamp\"].dt.hour\noff_hours = df[(df[\"hour\"] \u003C 6) | (df[\"hour\"] > 22)]\nsuspicious = off_hours.groupby(\"user\").size().sort_values(ascending=False)\n```\n",{"name":5,"tags":25,"author":30,"domain":31,"license":15,"version":32,"subdomain":33,"description":34},[26,27,28,29],"detecting","insider","data","exfiltration","mahipal","cybersecurity","1.0","security-operations","Detects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload volume anomalies, and off-hours activity in endpoint and cloud logs. Uses pandas for behavioral analytics and statistical baselines. Use when investigating insider threats or building user behavior analytics for data loss prevention.\n","main","99825ad3f3bcc6597ddcc7294a14e6e922f2b67b","skills\u002Fdetecting-insider-data-exfiltration-via-dlp",0,"https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills","https:\u002F\u002Fgithub.com\u002Fjukeyman","https:\u002F\u002FRJBUSINESSSOLUTIONS.ORG","Credit and Finance Expert | Developer\r\n\r\nI'm Rick Jefferson, a seasoned credit and finance expert with over a decade of experience in financial literacy,","2026-07-13 07:03:29",{"source":8,"skillName":5,"commands":45,"prompt":55,"zipAvailable":56},[46,49,52],{"tool":47,"command":48},"npx","npx skills add jukeyman\u002Fjukeyman-skills --skill detecting-insider-data-exfiltration-via-dlp",{"tool":50,"command":51},"bunx","bunx skills add jukeyman\u002Fjukeyman-skills --skill detecting-insider-data-exfiltration-via-dlp",{"tool":53,"command":54},"pnpm","pnpm dlx skills add jukeyman\u002Fjukeyman-skills --skill detecting-insider-data-exfiltration-via-dlp","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-insider-data-exfiltration-via-dlp\u002FSKILL.md",true,[58,62,68],{"path":59,"resourceType":59,"resourceTypeDesc":60,"sizeBytes":61,"sourceHtmlUrl":16},"LICENSE","许可证",11255,{"path":63,"resourceType":64,"resourceTypeDesc":65,"sizeBytes":66,"sourceHtmlUrl":67},"references\u002Fapi-reference.md","REFERENCE","参考文档",1734,"https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-insider-data-exfiltration-via-dlp\u002Freferences\u002Fapi-reference.md",{"path":69,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":72,"sourceHtmlUrl":73},"scripts\u002Fagent.py","SCRIPT","脚本",7179,"https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-insider-data-exfiltration-via-dlp\u002Fscripts\u002Fagent.py",[75,83,90,97,104,112],{"skillNo":76,"name":77,"nameZh":6,"description":78,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":79,"licenseFileUrl":6,"sourceHtmlUrl":80,"categories":81,"keywords":82,"publishedAt":20},"01M79ANS2SM329NEP5ZCX106RR","zustand-store-creator","Create zustand store creator operations. Auto-activating skill for Frontend Development.\nTriggers on: zustand store creator, zustand store creator\nPart of the Frontend Development skill category. Use when working with zustand store creator functionality. Trigger with phrases like \"zustand store creator\", \"zustand creator\", \"zustand\".","MIT","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fzustand-store-creator\u002FSKILL.md",[],[],{"skillNo":84,"name":85,"nameZh":6,"description":86,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":79,"licenseFileUrl":6,"sourceHtmlUrl":87,"categories":88,"keywords":89,"publishedAt":20},"01M79AMZKP4YDEZ7EHG1Y7PP74","zero-trust-config-helper","Configure with zero trust config helper operations. Auto-activating skill for Security Advanced.\nTriggers on: zero trust config helper, zero trust config helper\nPart of the Security Advanced skill category. Use when configuring systems or services. Trigger with phrases like \"zero trust config helper\", \"zero helper\", \"zero\".","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fzero-trust-config-helper\u002FSKILL.md",[],[],{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":79,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":96,"publishedAt":20},"01M79AMJSBCEJQNBTYNAHYN5HM","zapier-integration-helper","Assist with zapier integration helper operations. Auto-activating skill for Business Automation.\nTriggers on: zapier integration helper, zapier integration helper\nPart of the Business Automation skill category. Use when working with APIs or building integrations. Trigger with phrases like \"zapier integration helper\", \"zapier helper\", \"zapier\".","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fzapier-integration-helper\u002FSKILL.md",[],[],{"skillNo":98,"name":99,"nameZh":6,"description":100,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":79,"licenseFileUrl":6,"sourceHtmlUrl":101,"categories":102,"keywords":103,"publishedAt":20},"01M79AHJZGVMARS13VFQYRR1MP","yaml-config-validator","Validate yaml config validator operations. Auto-activating skill for DevOps Basics.\nTriggers on: yaml config validator, yaml config validator\nPart of the DevOps Basics skill category. Use when configuring systems or services. Trigger with phrases like \"yaml config validator\", \"yaml validator\", \"yaml\".","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fyaml-config-validator\u002FSKILL.md",[],[],{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":79,"licenseFileUrl":108,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":20},"01M79AHGDZRN0020RDQSQDPAM8","xvary-stock-research","Thesis-driven equity analysis from public SEC EDGAR and market data; \u002Fanalyze, \u002Fscore, \u002Fcompare workflows with bundled Python tools (Claude Code, Cursor, Codex).","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fxvary-stock-research\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fxvary-stock-research\u002FSKILL.md",[],[],{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":79,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":118,"publishedAt":20},"01M79AHCYJ9FV9RMHQ24HDRN33","xss-vulnerability-scanner","Scan xss vulnerability scanner operations. Auto-activating skill for Security Fundamentals.\nTriggers on: xss vulnerability scanner, xss vulnerability scanner\nPart of the Security Fundamentals skill category. Use when working with xss vulnerability scanner functionality. Trigger with phrases like \"xss vulnerability scanner\", \"xss scanner\", \"xss\".","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fxss-vulnerability-scanner\u002FSKILL.md",[],[]]