Breach Detection System

What it does

When your agent uses it

• Tasks that involve Security operations
• Tasks that involve Anomaly detection
• Tasks that involve Privacy and GDPR

Example prompts

• “Use the breach-detection-system skill to implement technical breach detection capabilities including SIEM integration, DLP alert configuration…”
• “/breach-detection-system”

Requirements

• Python 3

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

1. 1SIEM correlation rule or DLP policy triggers an alert.
2. 2Alert is enriched with contextual data: user identity, data classification of affected system, data subject count estimate.
3. 3If the affected system is classified as containing personal data (tagged in the CMDB), the alert is automatically duplicated to the…
4. 4Privacy incident coordinator performs initial triage within 30 minutes.
5. 5If personal data breach is confirmed, the Art. 33 72-hour clock activation is triggered and the DPO is notified.

What it can do on your machine

Read from SKILL.md and the folder at commit 9b2ef9e. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Ships 1 file in scripts/ (Python), which the agent can run.

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  No URLs in SKILL.md.

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Breach Detection System loads about 3k tokens when it runs, and up to ~5.8k if it reads all its reference files. Until then it costs about 121 tokens; SKILL.md has 1,072 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~121

When it runs · the whole SKILL.md, loaded when a task matches

~3k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~5.8k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Privacy-Data-Protection-Skills at commit 9b2ef9e, republished under its Apache-2.0 licence (© mukul975). 1,072 words, ~2,962 tokens.

name

breach-detection-system

description

Implements technical breach detection capabilities including SIEM integration, DLP alert configuration, anomaly detection rules, and insider threat monitoring. Provides a breach classification taxonomy across confidentiality, integrity, and availability dimensions. Covers detection tool selection, alert tuning, and integration with privacy incident response workflows. Keywords: breach detection, SIEM, DLP, anomaly detection, insider threat, classification.

license

Apache-2.0

metadata.author

mukul975

metadata.version

1.0

metadata.domain

privacy

metadata.subdomain

data-breach-response

metadata.tags

breach-detection, siem, dlp, anomaly-detection, insider-threat, classification

Trigger: Single user account accesses more than 500 unique personal data records within a 30-minute window.
Data sources: PostgreSQL audit logs, application access logs.
Severity: High
Action: Create incident ticket, alert SOC analyst, notify DPO on-call.
False positive mitigation: Whitelist batch processing service accounts (reviewed quarterly). Flag whitelisted accounts if access occurs outside scheduled batch windows.

Trigger: Outbound data transfer exceeding 50MB to an unclassified external destination from a system containing personal data.
Data sources: Palo Alto firewall, CrowdStrike network telemetry, DLP alerts.
Severity: Critical
Action: Automated network isolation of source endpoint, SOC analyst investigation, DPO notification.
False positive mitigation: Baseline normal data transfer patterns per endpoint. Whitelist approved SaaS destinations (Salesforce, Workday, etc.).

Trigger: Database administrator account performs SELECT queries on personal data tables outside of change management windows OR from an unrecognized source IP.
Data sources: PostgreSQL audit logs, Okta authentication logs, IP geolocation.
Severity: High
Action: Alert SOC lead and database security team. Log full query text for forensic review.

Trigger: More than 20 file rename/encrypt operations per second on file servers or database storage volumes, OR known ransomware file extension creation (.lockbit, .encrypted, .crypt).
Data sources: CrowdStrike Falcon, Windows file audit logs, storage IOPS monitoring.
Severity: Critical
Action: Automated isolation of affected system, activate incident response team, preserve forensic image.

Trigger: More than 50 failed authentication attempts against personal data systems within 10 minutes from a single source, OR more than 200 failed attempts across multiple accounts from the same source within 30 minutes (password spray).
Data sources: Active Directory, Okta, application authentication logs.
Severity: Medium (escalates to High if followed by successful authentication).
Action: Block source IP at firewall, SOC investigation, check for compromised credentials.

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 4 other files (scripts, references, assets) in skills/privacy/breach-detection-system of mukul975/Privacy-Data-Protection-Skills.

• SKILL.md
• assets/template.md
• references/standards.md
• references/workflows.md
• scripts/process.py

Open the folder on GitHubat commit 9b2ef9e