Add Insider Threat Analyst agent preset to Security category

[ahmadvh]

Context

Octochains provides built-in "preset" agents, pre-configured domain specialists designed to run in parallel pipelines. Each preset pairs a role (e.g., "CEO Agent") with a SKILL.md file defining its domain procedure.

The Security category uses these presets to analyze log and endpoint data from different angles without overlap:

• security_threat_hunter (Merged): Focuses on external intrusions (IoCs, MITRE ATT&CK tactics).
• insider_threat_analyst (This Issue): Focuses on internal misuse by legitimate, authenticated users.

---

Goal

Implement the insider_threat_analyst agent preset, following the same pattern as security_threat_hunter.

Refer to Adding a New Official Agent Preset in CONTRIBUTING.md for the setup guide.

---

Preset Specification

• Role: "Insider Threat Analyst"
• Goal: Detect anomalous behavior from authenticated users (e.g., unusual data exports, off-hours access, unauthorized exfiltration).
• Expected Inputs: Access logs, export/download records, and privileged account activity.
• Skill Name: insider-threat-behavioral-analysis
• Skill Requirements:
  • Identify behavioral baseline deviations (timing, access volume).
  • Distinguish between user negligence and malicious intent (or flag if ambiguous).
  • Scope Constraint: Do NOT analyze external IoCs or unauthenticated intrusions (leave those to security_threat_hunter).

---

Checklist

• Create Skill: Add src/octochains/agents/skills/security/insider-threat-behavioral-analysis/SKILL.md (include name, description, and version frontmatter).
• Create Factory Function: Add insider_threat_analyst() to src/octochains/agents/presets.py (see cfo_agent or security_threat_hunter for reference).
• Export Agent: Import and add insider_threat_analyst to __all__ in src/octochains/agents/__init__.py.
• Add Tests: Update tests/test_presets.py to verify:
  • Fails fast without an llm_callable
  • Attaches the correct skill
  • Contains non-empty role and goal fields
  • Merges extra_skills correctly

---

First-time contributor? This is a beginner-friendly "follow the recipe" task with established patterns in the codebase. Feel free to drop a comment below if you want to discuss the skill spec before opening a PR!

[ahmadvh]

Hey @Leenaa-patil

While mapping out the demo scenario, it became clear the Security category would benefit from a couple more presets first, right now security_threat_hunter is the only one in that category, and a good cookbook demo deserves more than one voice on the security side of the table.

So we're going to pause on the cookbook tracking issue for just a bit and round out the Security category first. I've opened three new issues for this:

• (This Issue) insider-threat-analyst
• Add Identity & Access Auditor agent preset to Security category #19 identity_access_auditor
• Add Breach Notification Analyst agent preset to Security category #20 breach_notification_analyst

Given you built the original security_threat_hunter, you're honestly the best-positioned person in the project to take on any of these — no need to start from scratch on context, you already know this corner of the codebase. Feel free to pick whichever one interests you most (or more than one, if you're up for it!). They're independent, so no pressure to take all three.

Once we've got a couple more Security presets in place, the cookbook demo will actually be richer for it, I'm thinking your Threat Hunter could end up triaging alongside one of these new presets and the Data Sovereignty Auditor and CFO agent, which makes for a much more interesting multi-agent scenario than what we originally sketched.

No rush at all, take a look whenever you have time, and let me know which one(s) you'd like to run with!

[Leenaa-patil]

Hey @ahmadvh

I'd love to continue expanding the Security category.. I'll start with the Insider Threat Analyst agent preset and if time permits, i'd be happy to pick up the others as well..
Looking forward to make a much richer cookbook demo!

[ahmadvh]

@Leenaa-patil Perfect. then I will assign this issue to you.
Thanks Leena, looking forward to another pull request from you.