Skill UI

Detects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload-volume anomalies, and off-hours activity from endpoint and cloud logs; ideal for investigations or building user-behavior analytics for DLP.

Outlines how to deploy Amazon Macie, Azure Information Protection, and Google Cloud DLP to discover, classify, and protect sensitive data across cloud storage, databases, and pipelines, including scanning, custom identifiers, de-identification, and compliance workflows.

Implements comprehensive Google Workspace admin hardening with FIDO2-backed MFA policies, phishing-resistant access controls, email authentication (SPF/DKIM/DMARC), DLP rules, OAuth app oversight, and external sharing restrictions for enterprise-grade cloud office defense.

Investigates insider threat indicators such as data exfiltration, unauthorized access, and policy violations by correlating SIEM analytics, DLP alerts, UEBA signals, and HR data to build timelines when referrals or anomalies arise.