Skill UI

Hindsight is an open-source digital forensics tool designed to parse and correlate artifacts from Chromium-based browsers (Chrome, Edge, Brave, Opera). It extracts comprehensive data, including browsing history, cookies, download records, autofill data, and saved passwords, generating unified, chronological timelines essential for incident response, insider threat investigation, and digital forensics cases.

A comprehensive digital forensics technique used to investigate removable media usage. It parses artifacts from Windows registry (USBSTOR, MountedDevices), Event Logs, and SetupAPI logs to track which USB devices were connected, when they were used, and establishing a timeline for potential data exfiltration or insider threat activity.

This skill analyzes AWS CloudTrail logs to detect suspicious API call patterns, such as new event sources, geographic anomalies, or high-frequency usage. It establishes a statistical baseline of normal activity and flags deviations indicative of compromised credentials, privilege escalation, or insider threats, providing a detailed JSON report for security investigation and threat hunting.

This skill provides structured procedures and Python examples for detecting internal data exfiltration. It analyzes endpoint, cloud, and email logs by establishing behavioral baselines and performing statistical anomaly detection. Use cases include investigating insider threats, monitoring DLP policy violations, and building robust User and Entity Behavior Analytics (UEBA) rules for SOC teams.

This guide details methodologies for proactively hunting and detecting various insider threat indicators. It focuses on identifying unusual data access patterns, off-hours activity, mass file exfiltration, and unauthorized privilege abuse. By correlating data from EDR and SIEM platforms, security teams can scope compromises, simulate attack chains, and significantly enhance proactive threat detection capabilities.

This skill implements User and Entity Behavior Analytics (UEBA) to detect sophisticated insider threats. It builds behavioral baselines from diverse log sources (authentication, file access, network) using Elasticsearch/OpenSearch. It calculates anomaly scores and performs peer group analysis to identify deviations indicative of data exfiltration, privilege abuse, or unauthorized access patterns.

This skill provides SOC teams with a structured, multi-source workflow to investigate potential insider threats. It correlates data from SIEM, DLP, EDR, and HR feeds to detect data exfiltration attempts (via cloud, USB, email), unauthorized access patterns, and policy violations. It is crucial for building comprehensive investigation timelines, especially when handling departing employees or suspected data theft.

This skill provides a comprehensive, multi-stage guide for investigating insider threats. It covers the entire lifecycle, from receiving an allegation and ensuring legal authorization, to covert evidence collection (DLP logs, endpoint forensics), advanced user behavior pattern analysis, and reconstructing a detailed activity timeline for potential legal action. Essential for security incident response.

This skill performs User and Entity Behavior Analytics (UEBA) to identify anomalous user activities such as impossible travel, unusual access patterns, and privilege abuse. It establishes behavioral baselines using SIEM logs and statistical analysis, helping SOC teams detect insider threats and compromised accounts by flagging deviations from normal user behavior. Use when monitoring security hygiene and suspicious activity is critical.

This skill guides the deployment and strategic use of honeytokens and canarytokens (decoy credentials, files, URLs, etc.). These high-fidelity decoys are designed to detect unauthorized access, insider threats, or adversary reconnaissance by triggering alerts upon any interaction, providing early warning deep within the kill chain.