Insider threat investigation files

Detects insider-threat investigation files: insider-risk or employee investigation wording with populated subject details (employee, position, case number, allegation) and user-activity evidence. Topic wording alone is discovery-only.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: the topic phrase alone is discovery-only; enforcement needs populated structure (a populated subject/case field (subject employee, employee/staff ID, position, department, manager, case/referral number, investigator, allegation) or an activity artefact (timestamp, file-volume transfer, file path, IPv4)), and 85 needs two distinct structures plus independent insider-behaviour (exfiltration, after hours, resignation, DLP alert, removable media, disciplinary) evidence, so policies, blank forms and training text stay below 75.
Detection quality: Topic false positive
Jurisdictions: global
Regulations: Privacy Act 1988 (Cth), Fair Work Act 2009 (Cth), GDPR
Frameworks: ISO 27001, NIST CSF
Data categories: security, pii
Scope: wide
Risk rating: 8
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:insider\s+(?:threat|risk)\s+(?:investigation|case|referral|inquiry|file|report|alert)s?|(?:employee|staff)\s+(?:misconduct\s+)?investigation\s+(?:file|report|record)|user\s+activity\s+monitoring\s+(?:report|alert|findings))\b

Corroborative evidence keywords

exfiltration, after hours, resignation, disciplinary, DLP alert, removable media, personal email, personal cloud, HR, privileged access

Proximity: 300 characters

Should match

The insider threat referral was passed to People and Culture for review. — Discovery probe (65)
Insider threat investigation file Subject employee: Avery Teston Department: Finance — Medium-tier probe (75) - populated subject fields
Insider threat investigation file - case IT-2026-017 Subject employee: Avery Teston Position: Senior Payroll Officer Investigator: Jordan Staffson 2026-09-03 22:41 - 1,240 files copied to removable media after hours; DLP alert on personal email upload two days after resignation notice. — High-tier probe (85) - subject fields, activity artefacts and behaviour context

Should not match

unrelated generic text — No relevant phrase context
placeholder value 12345 — Random text should not match
Policy statement: insider threat investigations follow the code of conduct and procedural fairness. — Policy text
Insider threat investigation file template Subject employee: ________ Allegation: [insert] — Blank template
News report: an insider risk case at a bank saw 1,240 files copied to a USB drive after hours. — News framing

Known false positives

Insider-threat programme policies and awareness material. Mitigation: Topic wording is discovery-only; policy/training framing is excluded.