Insider

Insider and data-loss alerts playbook

Describe unusual activity by a trusted person accurately and fairly, and hand it to the right team.

Use this when: A DLP alert, large uploads to personal storage, or out-of-hours access to sensitive systems.

Steps

0 of 6 ticked

1. State what the logs showHow much data, to where, what labels, when. Stick to facts, not guesses about intent.
2. Look for a business reasonAn incident ticket, an on-call rota, an approved transfer or a project record often explains activity.
3. Add context carefullyFacts such as a resignation or a role change raise risk, but they are context, not proof of wrongdoing.
4. Compare with normal behaviourHas this user done this before? Is the volume or time unusual for them?
5. Preserve the evidenceKeep the proxy, DLP and access logs. Do not delete or change anything.
6. Escalate to the right teamInsider cases usually go to HR and an insider-risk or security lead. Do not confront the user yourself or discuss it with colleagues.

DLP consoleWeb proxy logsTicketing and on-call records

Found something confusing or unrealistic?