1. A method of monitoring data access to enterprise information assets, comprising: using a rules-based language to specify a policy filter, the policy filter specifying an insider attack and defining (a) an action that a trusted user may attempt to take with respect to an enterprise information asset stored on a server, and (b) a response that is to be taken upon detection of the action; determining whether a trusted user's data access is indicative of the action as specified by the policy filter; and if the trusted user's data access is indicative of the action as specified by the policy filter, taking the response specified by the policy filter.