The NetClean ProActive Threat Analysis Add-on for Splunk enables organizations to detect and respond to high-confidence indicators of human insider risk by classifying SHA-1 file hashes against NetClean’s ProActive Threat Intelligence API. This add-on is designed to support security, compliance, and forensic teams by identifying known Child Sexual Abuse Material (CSAM) within enterprise environments. A positive classification represents a zero false positive signal and should be treated as a high-priority alert within existing incident response workflows. By integrating this add-on into Splunk, organizations can operationalize CSAM detection as part of their broader threat detection and insider risk management strategy.