<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Insider Threat Simulation

## UEBA Detection Queries

### Splunk UBA

| Search | Description |
|---|---|
| `index=ueba anomaly_type="data_exfiltration"` | Data exfil anomalies |
| `index=ueba anomaly_type="unusual_access"` | Unusual access patterns |
| `index=ueba risk_score>70` | High-risk user anomalies |

### Elastic ML

| Job | Description |
|---|---|
| `rare_process_by_user` | Unusual process execution |
| `high_count_network_events` | Unusual network volume |
| `rare_destination_country` | Unusual geo access |

## Insider Threat Indicators (ATT&CK)

| Technique | ID | Indicator |
|---|---|---|
| File and Directory Discovery | T1083 | Browsing outside normal scope |
| Data from Local System | T1005 | Bulk file copying |
| Local Data Staging | T1074.001 | Staging in temp directories |
| Exfil to Cloud Storage | T1567.002 | Upload to personal cloud |
| Valid Accounts | T1078 | Off-hours privileged access |

## Agent Script

```bash
# Create simulation
node agent.js create-simulation --name "Departing Employee" \
  --persona senior-developer --techniques T1083 T1005 T1074.001 T1567.002 \
  --output simulations/departing.yaml

# Execute
node agent.js execute-simulation --simulation simulations/departing.yaml \
  --delay-between-phases 60 --output results/sim.json

# Check UEBA
node agent.js check-ueba --results results/sim.json \
  --siem-url https://splunk:8089 --output results/ueba.json

# Report
node agent.js simulation-report --results results/sim.json \
  --detections results/ueba.json --output reports/insider.json
```
