Implement User and Entity Behavior Analytics (UEBA) using Elasticsearch/OpenSearch to build behavioral baselines, calculate anomaly scores, perform peer group analysis, and alert on insider threat indicators such as data exfiltration, privilege abuse, and unauthorized access. Use when building or tuning a UEBA pipeline rather than a one-off manual hunt.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-insider-threat-with-uebanpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-insider-threat-with-ueba -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-insider-threat-with-ueba -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/detecting-insider-threat-with-uebagh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-insider-threat-with-uebagit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-insider-threat-with-ueba ~/.claude/skills/detecting-insider-threat-with-ueba # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-insider-threat-with-ueba ~/.agents/skills/detecting-insider-threat-with-ueba # Codex, Cursor, Gemini CLI, Copilot, OpenCode