Interface InsiderRiskConfig

interface InsiderRiskConfig {
    bulkOperationThreshold: number;
    normalDays: number[];
    normalHoursEnd: number;
    normalHoursStart: number;
    permissionDenialRateThreshold: number;
    permissionMinAttempts: number;
    rubberStampApprovalRateThreshold: number;
    rubberStampMinDecisions: number;
    rubberStampThresholdMs: number;
}

Properties

bulkOperationThreshold: number

Bulk operation threshold

normalDays: number[]

Normal business days (0=Sun, 6=Sat)

normalHoursEnd: number

normalHoursStart: number

Normal business hours (24h format)

permissionDenialRateThreshold: number

Tool denial rate above this is anomalous

permissionMinAttempts: number

Minimum tool attempts for anomaly detection

rubberStampApprovalRateThreshold: number

Approval rate above this is suspicious

rubberStampMinDecisions: number

Minimum decisions to evaluate rubber-stamping

rubberStampThresholdMs: number

Approval faster than this (ms) is considered rubber-stamping