How I Detected an Insider Threat in Splunk When Every Single Action Looked Legitimate

No broken password. No exploit. No firewall alert. Just an employee using access they were supposed to have — to take data they weren’t…