Protection and Defense · PD-WRL-005
Insider Threat Analysis
From NICE Framework Components v2.2.0
Description
From NICE Framework Components v2.2.0
Free · NICE Framework Components v2.2.0Responsible for identifying and assessing the capabilities and activities of cybersecurity insider threats; produces findings to help initialize and support law enforcement and counterintelligence activities and investigations.
Tasks
From NICE Framework Components v2.2.0, open one for the AI skills Workforce Automation maps to it
Free · NICE Framework Components v2.2.0T1056 Acquire resources to support cybersecurity program goals and objectives
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1057 Conduct an effective enterprise continuity of operations program
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1062 Contribute insider threat expertise to organizational cybersecurity awareness program
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1084 Identify anomalous network activity
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1085 Identify potential threats to network resources
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1160 Develop risk mitigation strategies
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1162 Recommend security changes to systems and system components
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1227 Manage cybersecurity budget, staffing, and contracting
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1266 Recommend risk mitigation strategies
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1324 Process digital evidence
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1325 Document digital evidence
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1439 Assess the behavior of individual victims, witnesses, or suspects during cybersecurity investigations
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1510 Preserve digital evidence
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1592 Conduct cybersecurity reviews
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1690 Identify exploitable technical or operational vulnerabilities
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1712 Recommend potential courses of action
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1737 Develop intelligence collection strategies
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1743 Identify information collection gaps
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1799 Notify appropriate personnel of imminent hostile intentions or activities
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1801 Determine validity and relevance of information
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1969 Document system alerts
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1970 Escalate system alerts that may indicate risks
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1971 Disseminate anomalous activity reports to the insider threat hub
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1973 Conduct independent comprehensive assessments of target-specific information
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1974 Conduct insider threat risk assessments
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1975 Prepare insider threat briefings
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1976 Recommend risk mitigation courses of action (CoA)
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1977 Coordinate with internal and external incident management partners across jurisdictions
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1978 Recommend improvements to insider threat detection processes
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1979 Collect digital evidence that meets priority intelligence requirements
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1980 Develop digital evidence reports for internal and external partners
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1981 Develop elicitation indicators
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1982 Identify high value assets
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1983 Identify potential insider threats
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1985 Identify imminent or hostile intentions or activities
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1986 Develop a continuously updated overview of an incident throughout the incident's life cycle
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1987 Develop insider threat cyber operations indicators
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1988 Integrate information from cyber resources, internal partners, and external partners
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1989 Advise insider threat hub inquiries
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1990 Conduct cybersecurity insider threat inquiries
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1991 Deliver all-source cyber operations and intelligence indications and warnings
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1992 Interpret network activity for intelligence value
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1993 Monitor network activity for vulnerabilities
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1994 Identify potential insider risks to networks
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1995 Document potential insider risks to networks
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1996 Report network vulnerabilities
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1997 Develop insider threat investigation plans
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1998 Investigate alleged insider threat cybersecurity policy violations
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1999 Refer cases on active insider threat activities to law enforcement investigators
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2001 Establish an insider threat risk management assessment program
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2003 Evaluate organizational insider risk response capabilities
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2004 Document insider threat information sources
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2005 Conduct insider threat studies
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2006 Identify potential targets for exploitation
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2007 Analyze potential targets for exploitation
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2009 Develop insider threat targets
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2010 Maintain User Activity Monitoring (UAM) tools
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2011 Monitor the output from User Activity Monitoring (UAM) tools
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yet
Knowledge
From NICE Framework Components v2.2.0
Free · NICE Framework Components v2.2.0- K0636Knowledge of decryption tools and techniques
- K0637Knowledge of data repositories
- K0656Knowledge of network collection tools and techniques
- K0657Knowledge of network collection policies and procedures
- K0674Knowledge of computer networking protocols
- K0675Knowledge of risk management processes
- K0676Knowledge of cybersecurity laws and regulations
- K0677Knowledge of cybersecurity policies and procedures
- K0678Knowledge of privacy laws and regulations
- K0679Knowledge of privacy policies and procedures
- K0682Knowledge of cybersecurity threats
- K0683Knowledge of cybersecurity vulnerabilities
- K0684Knowledge of cybersecurity threat characteristics
- K0689Knowledge of network infrastructure principles and practices
- K0707Knowledge of database systems and software
- K0710Knowledge of enterprise cybersecurity architecture principles and practices
- K0721Knowledge of risk management principles and practices
- K0734Knowledge of Risk Management Framework (RMF) requirements
- K0735Knowledge of risk management models and frameworks
- K0751Knowledge of system threats
- K0752Knowledge of system vulnerabilities
- K0778Knowledge of enterprise information technology (IT) architecture principles and practices
- K0784Knowledge of insider threat laws and regulations
- K0785Knowledge of insider threat tools and techniques
- K0802Knowledge of chain of custody policies and procedures
- K0862Knowledge of data remediation tools and techniques
- K0870Knowledge of enterprise architecture (EA) reference models and frameworks
- K0871Knowledge of enterprise architecture (EA) principles and practices
- K0909Knowledge of abnormal physical and physiological behaviors
- K1014Knowledge of network security principles and practices
- K1023Knowledge of network exploitation tools and techniques
- K1031Knowledge of risk mitigation tools and techniques
- K1085Knowledge of exploitation tools and techniques
- K1096Knowledge of data analysis tools and techniques
- K1151Knowledge of digital evidence cataloging tools and techniques
- K1152Knowledge of digital evidence extraction tools and techniques
- K1154Knowledge of digital evidence packaging tools and techniques
- K1155Knowledge of digital evidence preservation tools and techniques
- K1180Knowledge of organizational cybersecurity goals and objectives
- K1188Knowledge of organizational policies and procedures
- K1197Knowledge of priority intelligence requirements
- K1209Knowledge of risk mitigation principles and practices
- K1241Knowledge of cultural, political, and organizational assets
- K1242Knowledge of cybersecurity review processes and procedures
- K1243Knowledge of cybersecurity threat remediation principles and practices
- K1244Knowledge of cybersecurity tools and techniques
- K1245Knowledge of data exfiltration tools and techniques
- K1246Knowledge of data handling tools and techniques
- K1247Knowledge of data monitoring tools and techniques
- K1248Knowledge of digital and physical security vulnerabilities
- K1249Knowledge of digital and physical security vulnerability remediation principles and practices
- K1250Knowledge of external organization roles and responsibilities
- K1251Knowledge of external referrals policies and procedures
- K1252Knowledge of high value asset characteristics
- K1254Knowledge of insider threat hub policies and procedures
- K1255Knowledge of insider threat hub operations
- K1256Knowledge of insider threat operational indicators
- K1257Knowledge of insider threat policies and procedures
- K1258Knowledge of insider threat tactics
- K1259Knowledge of insider threat targets
- K1260Knowledge of intelligence laws and regulations
- K1261Knowledge of known insider attacks
- K1262Knowledge of network endpoints
- K1263Knowledge of notification policies and procedures
- K1265Knowledge of organizational objectives, resources, and capabilities
- K1267Knowledge of previously referred potential insider threats
- K1268Knowledge of risk reduction metrics
- K1269Knowledge of security information and event management (SIEM) tools and techniques
- K1270Knowledge of suspicious activity response processes
- K1271Knowledge of system alert policies and procedures
- K1272Knowledge of system components
- K1273Knowledge of threat investigation policies and procedures
- K1274Knowledge of threat modeling tools and techniques
- K1275Knowledge of User Activity Monitoring (UAM) tools and techniques
Skills
From NICE Framework Components v2.2.0
Free · NICE Framework Components v2.2.0- S0378Skill in decrypting information
- S0391Skill in creating technical documentation
- S0442Skill in collecting network data
- S0477Skill in identifying anomalous activity
- S0540Skill in identifying network threats
- S0558Skill in developing algorithms
- S0559Skill in performing data structure analysis
- S0579Skill in preparing reports
- S0588Skill in performing threat modeling
- S0610Skill in communicating effectively
- S0688Skill in performing network data analysis
- S0690Skill in performing midpoint collection data analysis
- S0728Skill in preparing briefings
- S0748Skill in querying data
- S0791Skill in presenting to an audience
- S0817Skill in building internal and external relationships
- S0821Skill in collaborating with internal and external stakeholders
- S0848Skill in performing behavioral analysis
- S0854Skill in performing data analysis
- S0866Skill in performing log file analysis
- S0874Skill in performing network traffic analysis
- S0890Skill in performing threat analysis
- S0896Skill in recognizing behavioral patterns
- S0900Skill in analyzing information from multiple sources
- S0902Skill in building relationships remotely and in person
- S0904Skill in correlating data from multiple tools
- S0905Skill in determining what information may helpful to a specific audience
- S0906Skill in identifying insider risk security gaps
- S0907Skill in identifying insider threats
- S0908Skill in determining the importance of assets
- S0909Skill in integrating information from multiple sources
- S0910Skill in performing cyberintelligence data analysis
- S0911Skill in performing data queries
- S0912Skill in performing human behavioral analysis
- S0913Skill in performing link analysis
- S0916Skill in recognizing recurring threat incidents
Workforce Automation analysis, not part of the source
O*NET jobs this role maps to
WFA · Part of the paid plan when accounts openJobs from the ETO-CSET NICE/O*NET crosswalk (2024), with the share of each job’s detailed work activities (DWAs) that has a mapped AI skill. We haven’t mapped AI skills to this role’s own tasks yet; until then, these jobs show the coverage the role reaches through the occupations it maps to.
- Information Security Analysts 15-1212.00DWAs covered10 of 10
- Fraud Examiners, Investigators and Analysts 13-2099.04DWAs covered3 of 21
Equivalents
O*NET jobs
Mapped to this role by the ETO-CSET NICE/O*NET crosswalk (2024); jobs from O*NET 30.3
Free · O*NET 30.3- Information Security Analysts 15-1212.00
- Fraud Examiners, Investigators and Analysts 13-2099.04
DCWF work roles
From DoD DCWF Tool v5.3 (2026-09-25), linked by its NCWF ID or NICE's OPM code
Free · DoD DCWF Tool v5.3 (2026-09-25)No published DCWF equivalent.