1. A computer-implemented method for detecting and investigating insider fraud, comprising: identifying one or more insider threat detection rules for an enterprise, the enterprise associated with a plurality of enterprise insiders; obtaining, from a plurality of behavioral data sources, behavioral data for a first enterprise insider of the plurality of enterprise insiders, the behavioral data for the first enterprise insider describing at least an action of the first enterprise insider; determining a threat score for the first enterprise insider based on the behavioral data for the first enterprise insider and one or more of the insider threat detection rules; and initiating, when the threat score satisfies a threat threshold, one or more protective actions.