How SOAR Can Probe for Insider Threats