SOAR & Playbook Orchestration Agents
Problem Statement
Insider threats involving massive bulk file downloads from cloud storage (Google Drive, OneDrive, SharePoint) prior to employee departure require rapid intervention to stop data loss.
Goal
Deploy an agent that monitors bulk file export notifications, evaluates sensitive file contents, temporarily restricts sharing permissions, and notifies the Security Operations Center.
Outcome Measurement
- Data Loss Prevention: 100% of unauthorized bulk confidential file downloads automatically revoked within 1 minute.
- False Positives: Zero impact on authorized backup operations.
How the Code was Built
Infers user intent from file download velocity and data classification flags.
Executable Code
from pydantic import BaseModel, Fieldfrom langchain_openai import ChatOpenAIclass DLPResponse(BaseModel): user_id: str suspend_drive_access: bool revoke_sharing_links: bool alert_hr: bool reasoning: strdef evaluate_insider_exfiltration(user: str, downloaded_file_count: int, sensitive_label_count: int, employee_status: str) -> DLPResponse: llm = ChatOpenAI(model="gpt-4o", temperature=0) structured_llm = llm.with_structured_output(DLPResponse) prompt = f"""Evaluate potential insider exfiltration event:User: {user}Downloaded Files in last 1 hour: {downloaded_file_count}Files labeled 'RESTRICTED' or 'CONFIDENTIAL': {sensitive_label_count}HR Status: {employee_status}""" return structured_llm.invoke(prompt)if __name__ == "__main__": res = evaluate_insider_exfiltration("emp_404@company.com", 450, 120, "Submitted Resignation Yesterday") print(f"Suspend Access: {res.suspend_drive_access}") print(f"Alert HR: {res.alert_hr}") print(f"Reasoning: {res.reasoning}")
Leave a Reply