feat: add 4 new cybersecurity skills - UEBA insider threat, BeyondCorp zero trust, Linux kernel rootkits, CobaltStrike beacon hunting

skills/detecting-insider-threat-with-ueba/references/api-reference.md

@@ -0,0 +1,75 @@
+# API Reference: Detecting Insider Threat with UEBA
+
+## Elasticsearch Aggregation Queries
+
+### Per-User Daily Activity Baseline
+```json
+{
+  "aggs": {
+    "users": {
+      "terms": {"field": "user.name", "size": 5000},
+      "aggs": {
+        "daily_events": {"date_histogram": {"field": "@timestamp", "calendar_interval": "day"}},
+        "unique_hosts": {"cardinality": {"field": "host.name"}},
+        "data_volume": {"sum": {"field": "bytes_transferred"}}
+      }
+    }
+  }
+}
+```
+
+### Anomaly Detection (Z-Score > 3)
+```python
+from elasticsearch import Elasticsearch
+es = Elasticsearch(["https://localhost:9200"], api_key="base64key")
+result = es.search(index="logs-*", body=query)
+z_score = (current - baseline_avg) / baseline_std
+```
+
+## Insider Threat Indicators
+
+| Indicator | Detection Method | Severity |
+|-----------|-----------------|----------|
+| Activity spike | Z-score > 3 standard deviations | High |
+| Data exfiltration | Volume > 5x daily average | Critical |
+| New host access | Unique hosts > 2x baseline | High |
+| Off-hours activity | Login outside 06:00-22:00 | Medium |
+| Peer group outlier | Activity > 3x peer average | Medium |
+| Privilege escalation | New admin role assignment | Critical |
+| Resignation + download | HR flag + high data volume | Critical |
+
+## Elasticsearch Python Client
+
+```bash
+pip install elasticsearch>=8.0
+```
+
+| Method | Description |
+|--------|-------------|
+| `es.search(index, body)` | Execute aggregation query |
+| `es.indices.get_alias("logs-*")` | List matching indices |
+| `es.count(index)` | Get document count |
+
+## Risk Scoring Model
+
+| Score Range | Risk Level | Action |
+|-------------|------------|--------|
+| 0 - 30 | Low | No action |
+| 31 - 60 | Medium | Monitor |
+| 61 - 80 | High | SOC investigation |
+| 81 - 100 | Critical | Immediate response |
+
+## MITRE ATT&CK Insider Techniques
+
+| Technique | ID | UEBA Detection |
+|-----------|----|----------------|
+| Data from Local System | T1005 | Volume anomaly on file servers |
+| Exfiltration Over Web Service | T1567 | Cloud upload volume spike |
+| Account Manipulation | T1098 | Unusual privilege changes |
+| Valid Accounts | T1078 | Off-hours or location anomaly |
+
+### References
+
+- Elasticsearch Python Client: https://elasticsearch-py.readthedocs.io/
+- MITRE Insider Threat: https://attack.mitre.org/techniques/T1078/
+- NIST SP 800-53 AC-2: https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/