npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
- When investigating security incidents that require detecting insider data exfiltration via dlp
Detects insider data exfiltration via DLP by analyzing logs for policy violations, file access patterns, upload anomalies, and off-hours activity using pandas.
Detects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload volume anomalies, and off-hours activity using pandas for behavioral baselines. Useful for threat investigations and DLP user analytics.
Investigates insider threat indicators like data exfiltration, unauthorized access, policy violations, and pre-departure behaviors using SIEM analytics, DLP alerts, and HR correlation. For SOC teams with HR referrals or anomalous data movement.
Share bugs, ideas, or general feedback.
Analyze endpoint activity logs, cloud storage access, and email DLP events to detect data exfiltration patterns using behavioral baselines and statistical anomaly detection.
import pandas as pd
df = pd.read_csv("file_activity.csv", parse_dates=["timestamp"])
# Baseline: average daily upload volume per user
baseline = df.groupby(["user", df["timestamp"].dt.date])["bytes_transferred"].sum()
user_avg = baseline.groupby("user").mean()
# Alert on users exceeding 3x their baseline
today = df[df["timestamp"].dt.date == pd.Timestamp.today().date()]
today_totals = today.groupby("user")["bytes_transferred"].sum()
anomalies = today_totals[today_totals > user_avg * 3]
Key indicators:
# Detect off-hours activity
df["hour"] = df["timestamp"].dt.hour
off_hours = df[(df["hour"] < 6) | (df["hour"] > 22)]
suspicious = off_hours.groupby("user").size().sort_values(ascending=False)