Employee monitoring and insider-threat signals
Define purpose-limited telemetry, review anomalous activity, and protect employee-sensitive investigations.
Insider-threat detections identify anomalous activity involving employee accounts or devices. They support investigation; they do not establish motive or replace a documented human review.
Set collection boundaries
An Owner opens Organization → Privacy → Endpoint monitoring to define the monitoring purpose, permitted event categories, retention, and reviewers. Administrators enable only the endpoint telemetry needed by those purposes at Policies → Endpoint → Telemetry. Employee content capture is not implied by device enrollment.
Give sensitive-detail access to a small review group through Organization → Members → Access → Employee-sensitive data. Ordinary incident viewers see masked summaries. Review collection and access decisions with the organization's privacy and employee-relations owners before enabling broad monitoring; Guard does not supply a universal employment-policy authorization.
Investigate a signal
Open Detections → Category → Insider activity, then inspect the baseline period, rule, source timestamps, affected data, destination, and missing observations. Bulk transfers, unusual access times, and removable-media events can be legitimate. New employees and changed job responsibilities can invalidate an older baseline.
Assign a restricted incident and record corroborating facts separately from hypotheses. If contacting the employee is consistent with the investigation plan, use a known business contact path to confirm the business purpose. Requests to isolate a device or suspend access require the normal response authority and approval; an anomaly score alone cannot approve those actions.
Preserve accountability
Attach only necessary evidence, preserve the original event IDs, and record who accessed sensitive detail. Export a redacted report for broader stakeholders through Reports → Create report → Audience. Raw artifacts need an independent evidence grant.
Close false positives with a reason and improve the specific rule or baseline. Do not erase the audit trail or disable all monitoring for an entire department. Use an expiring exception when a temporary business workflow needs a different threshold.