forked from beenuar/AiSOC
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathseed_demo.py
More file actions
3224 lines (3024 loc) · 128 KB
/
Copy pathseed_demo.py
File metadata and controls
3224 lines (3024 loc) · 128 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
"""Seed the database with a realistic demo tenant, user, and SOC dataset.
Run this from the host (the API container has the package on its PYTHONPATH):
docker compose exec api python -m app.scripts.seed_demo
# or, from the repo root:
pnpm seed:demo
The seed is idempotent — running it twice produces the same dataset and never
duplicates rows. Demo IDs are kept in sync with `app/api/v1/dev_auth.py` so the
auth bypass and the seeded data agree on who "demo@aisoc.dev" is.
Two modes:
* **Full seed** (default) — populates the canonical BOTS-shaped catalogue:
15 hand-crafted ``INC-RT-*`` incidents (with one in-flight investigation
on INC-RT-001), 28 randomised alerts, and the supporting connector set.
This is what ``pnpm aisoc:demo`` runs and what the hosted demo ships.
* **Quick seed** (``--demo-quick``) — populates exactly four deterministic
cases (DEMO-001 phishing, DEMO-002 cloud takeover, DEMO-003 insider exfil,
DEMO-004 ransomware) with a fixed wall-clock so re-runs are byte-stable.
This is the T6.4 screencast path — ``pnpm aisoc:demo --quick`` finishes
in under 4 minutes on a warm laptop. ``_purge_demo_quick`` deletes the
four DEMO-* cases before reseeding so re-running is a clean reset rather
than a duplicate.
"""
from __future__ import annotations
import argparse
import asyncio
import hashlib
import random
import sys
import uuid
from datetime import UTC, datetime, timedelta
from sqlalchemy import delete, select, text
from app.api.v1.dev_auth import (
DEMO_TENANT_ID,
DEMO_USER_EMAIL,
DEMO_USER_ID,
DEMO_USER_ROLE,
)
from app.core.security import get_password_hash
from app.db.database import AsyncSessionLocal
from app.models.alert import Alert
from app.models.case import Case, CaseTask, CaseTimeline
from app.models.connector import Connector
from app.models.investigation import (
InvestigationArtifact,
InvestigationEvent,
InvestigationRun,
)
from app.models.tenant import Tenant, User
# Deterministic random for reproducible seeds.
_rng = random.Random(42)
# ─── Reference data ────────────────────────────────────────────────────────────
# Case severities stay on the legacy 4-tier ladder — we don't open cases for
# pure `info` noise, so leaving `info` off avoids polluting the queue. Alerts
# use the full 5-tier ladder (`_ALERT_SEVERITIES` below) so the seed exercises
# every band defined by the v1.5 SOC Console Parity plan (W2).
_SEVERITIES = ["critical", "high", "medium", "low"]
_ALERT_SEVERITIES = ["critical", "high", "medium", "low", "info"]
_STATUSES = ["new", "triaged", "investigating", "resolved", "false_positive"]
_SOURCES = [
("CrowdStrike Falcon", "edr"),
("Microsoft Defender", "edr"),
("Splunk Cloud", "siem"),
("Cortex XDR", "edr"),
("AWS GuardDuty", "cloud"),
("Cloudflare WAF", "network"),
("Suricata IDS", "network"),
("Okta", "identity"),
("Sigma Engine", "detection"),
]
_TECHNIQUES = [
("TA0001", "Initial Access", "T1078", "Valid Accounts"),
("TA0002", "Execution", "T1059.001", "PowerShell"),
("TA0003", "Persistence", "T1547.001", "Registry Run Keys"),
("TA0004", "Privilege Escalation", "T1068", "Exploit for Priv Esc"),
("TA0005", "Defense Evasion", "T1027", "Obfuscated Files"),
("TA0006", "Credential Access", "T1110.001", "Password Brute Force"),
("TA0007", "Discovery", "T1087.001", "Local Account Discovery"),
("TA0008", "Lateral Movement", "T1021.001", "Remote Desktop Protocol"),
("TA0009", "Collection", "T1005", "Data from Local System"),
("TA0010", "Exfiltration", "T1041", "Exfiltration Over C2 Channel"),
("TA0011", "Command and Control", "T1071.001", "Web Protocols"),
("TA0040", "Impact", "T1486", "Data Encrypted for Impact"),
]
_TITLES = [
"Suspicious PowerShell encoded command on {host}",
"Multiple failed logins for {user} from {ip}",
"Possible ransomware behavior on {host}",
"Credential dumping detected via lsass on {host}",
"Unusual outbound traffic to {ip}",
"TOR exit node connection from {host}",
"Privilege escalation attempt for {user}",
"Anomalous OAuth grant from {user}",
"Data exfiltration to non-corp domain on {host}",
"Suricata: ET TROJAN beacon detected on {host}",
"AWS GuardDuty: UnauthorizedAccess:IAMUser/MaliciousIPCaller",
"Suspicious office macro executed on {host}",
"Kerberoasting attempt from {host}",
"Lateral movement via SMB from {host} to DC",
"Suspicious scheduled task creation on {host}",
"LSASS memory dump via procdump on {host}",
"Reverse shell via mshta.exe on {host}",
"CloudTrail: root account API call from {ip}",
"DLL side-loading in {host} AppData",
"Suspicious WMI execution by {user} on {host}",
]
# 20 richly described synthetic incident scenarios for the eval suite.
# Each entry: (title_template, tactic_ids, technique_ids, description_template)
_SYNTHETIC_INCIDENTS: list[tuple[str, list[str], list[str], str]] = [
(
"Ransomware staging detected on {host} — precursor IOCs found",
["TA0002", "TA0005", "TA0040"],
["T1059.001", "T1027", "T1486"],
"PowerShell dropper decoded and executed on {host}. Obfuscated payload staged in Temp. "
"Ransomware note template found. Linked to LockBit 3.0 campaign.",
),
(
"APT credential harvesting campaign targeting {user}",
["TA0006", "TA0003"],
["T1110.001", "T1547.001"],
"Brute-force spray from {ip} against {user}. Successful login established persistence via registry Run key. IoCs match APT28 TTPs.",
),
(
"Insider threat: bulk download of PII by {user}",
["TA0009", "TA0010"],
["T1005", "T1041"],
"{user} downloaded >10 GB of customer records from internal DLP-monitored share. "
"Traffic egressed to personal Google Drive from {host}.",
),
(
"Supply chain compromise: malicious npm package on {host}",
["TA0001", "TA0002"],
["T1195.001", "T1059.007"],
"Compromised npm package `event-stream` installed by CI pipeline on {host}. Post-install hook executed reverse shell to {ip}.",
),
(
"Kerberoasting and lateral movement from {host}",
["TA0006", "TA0008"],
["T1558.003", "T1021.001"],
"Service account TGS tickets requested en-masse from {host}. "
"Pass-the-hash lateral movement to finance server. Mimikatz signatures detected.",
),
(
"Cloud misconfiguration: public S3 bucket with PII exposed",
["TA0009", "TA0010"],
["T1530", "T1567.002"],
"S3 bucket `corp-hr-backups` set world-readable. 40 k employee records accessible. "
"CloudTrail shows external IP {ip} enumerating objects.",
),
(
"Zero-day exploit attempt against web application on {host}",
["TA0001", "TA0002"],
["T1190", "T1059.007"],
"WAF logs show SQL-injection and SSRF probes from {ip}. One request returned 200 with "
"internal metadata. Possible CVE-2024-XXXX exploitation.",
),
(
"Living-off-the-land: certutil download cradle on {host}",
["TA0002", "TA0005"],
["T1105", "T1218.009"],
"certutil.exe -urlcache invoked from cmd.exe spawned by outlook.exe. "
"Payload downloaded from {ip}. Proxy logs confirm file retrieval.",
),
(
"Identity provider compromise: SAML golden-ticket on {user}",
["TA0006", "TA0007"],
["T1606.002", "T1087.002"],
"Forged SAML assertion detected. Attacker pivoted to Azure AD as {user}. Account enumeration across O365 tenant followed.",
),
(
"Cryptominer dropped via vulnerable Docker socket on {host}",
["TA0001", "TA0002", "TA0040"],
["T1610", "T1059.004", "T1496"],
"Unauthenticated Docker API exploited. Container with XMRig spawned. "
"CPU usage spiked to 95%. Monero mining pool connections from {ip}.",
),
(
"DGA-based C2 traffic from {host} — Emotet botnet indicators",
["TA0011", "TA0010"],
["T1568.002", "T1041"],
"Domain generation algorithm (DGA) traffic observed from {host}. "
"200+ NXDomain replies per minute. IoCs match Emotet epoch 5 infrastructure.",
),
(
"BEC phishing: finance user {user} redirected payment",
["TA0001", "TA0040"],
["T1566.001", "T1657"],
"Spear-phishing email spoofed CFO. {user} clicked malicious link, credentials stolen. "
"Wire transfer of $250 k initiated to threat-actor account.",
),
(
"Active Directory DCSync from non-DC host {host}",
["TA0006", "TA0004"],
["T1003.006", "T1078.002"],
"Replication rights abused from workstation {host}. All domain NTLM hashes replicated. Matches skeleton key attack preparation.",
),
(
"Container escape via privileged pod on {host}",
["TA0004", "TA0007"],
["T1611", "T1082"],
"Kubernetes privileged pod created by rogue service account. cgroup escape to host namespace. Node file system accessed from pod.",
),
(
"Firmware implant detected on {host} UEFI partition",
["TA0003", "TA0005"],
["T1542.001", "T1027.002"],
"UEFI secure-boot violation alert. Unknown module in firmware image. Matches MosaicRegressor UEFI implant signatures.",
),
(
"Watering-hole attack: internal wiki delivering drive-by exploit",
["TA0001", "TA0002"],
["T1189", "T1203"],
"Internal Confluence page injected with malicious JS. Visitor {user} on {host} exploited via CVE-2024-1234 browser vulnerability.",
),
(
"Malicious USB autorun on air-gapped {host}",
["TA0001", "TA0009"],
["T1091", "T1005"],
"USB device inserted on air-gapped system {host}. AutoRun executed Python stager. Sensitive documents staged for exfiltration.",
),
(
"OAuth consent phishing targeting {user}'s Microsoft account",
["TA0001", "TA0006"],
["T1528", "T1550.001"],
"Malicious OAuth app granted Mail.Read and Files.Read.All to {user}. Inbox rules created to forward emails silently to attacker.",
),
(
"Memory-only implant (fileless) executed in {host} process",
["TA0002", "TA0005"],
["T1055.012", "T1620"],
"Process hollowing detected: svchost.exe replaced with Cobalt Strike beacon. No disk artefacts. IoC matches CS watermark 0x5A4D.",
),
(
"DNS tunnelling for data exfiltration from {host}",
["TA0011", "TA0010"],
["T1071.004", "T1048.003"],
"DNS query volume from {host} 50× baseline. TXT records contain base64 payload. "
"Matches iodine/dnscat2 tool signatures. Exfil volume ~200 MB.",
),
]
_HOSTS = [
"WIN-FIN-DB01",
"WIN-PROD-WEB02",
"MAC-SARAH-LT",
"LIN-K8S-NODE-03",
"WIN-HR-DESKTOP",
"DC01.corp.example.com",
"WIN-DEVOPS-LT",
]
_USERS = [
"alice@example.com",
"bob@example.com",
"carol@example.com",
"dave@example.com",
"svc-backup@example.com",
"eve@example.com",
]
# ─── Realistic incidents (BOTS / SecRepo-shaped) ───────────────────────────────
#
# 15 named, parameterised incident scenarios that ride on top of the random
# `_make_alert` corpus. Each scenario emits 1–3 alerts with telemetry shaped like
# Splunk BOTS / SecRepo public datasets (Sysmon, CloudTrail, Okta system log,
# Suricata, kube:audit, etc.) so investigators in the demo see field names they
# already recognise. The first scenario (INC-RT-001 LockBit 3.0) is the
# "in-flight investigation" showcase — see `_seed_in_flight_investigation`.
_REALISTIC_INCIDENTS: list[dict] = [
{
"key": "INC-RT-001",
"title": "LockBit 3.0 ransomware lateral spread on WIN-FIN-DB01",
"description": (
"Service account `svc-backup` triggered shadow-copy deletion, ransom-note "
"drop and SMB lateral movement to FIN-DB02. CrowdStrike encryption-pattern "
"detector fired against ~12k files. Investigation is in-flight; host is "
"being isolated."
),
"severity": "critical",
"status": "in_progress",
"host": "WIN-FIN-DB01",
"user": "svc-backup@example.com",
"src_ip": "203.0.113.42",
"tactic_ids": ["TA0002", "TA0005", "TA0008", "TA0040"],
"technique_ids": ["T1059.001", "T1027", "T1021.002", "T1486"],
"tags": ["ransomware", "lockbit", "in_flight", "showcase"],
"alerts": [
{
"title": "Sysmon: vssadmin shadow-copy deletion on WIN-FIN-DB01",
"severity": "critical",
"source": "Microsoft Sysmon",
"category": "edr",
"sourcetype": "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational",
"process": "vssadmin.exe",
"ai_score": 0.97,
"extra": {
"EventID": 1,
"ProcessId": 4892,
"ParentImage": r"C:\Windows\System32\cmd.exe",
"Image": r"C:\Windows\System32\vssadmin.exe",
"CommandLine": "vssadmin delete shadows /all /quiet",
"User": "NT AUTHORITY\\SYSTEM",
"IntegrityLevel": "System",
"Hashes": "SHA256=4DA1F312A214C07143ABEEAFB695D904",
},
},
{
"title": "CrowdStrike: high-volume file modification pattern on WIN-FIN-DB01",
"severity": "critical",
"source": "CrowdStrike Falcon",
"category": "edr",
"sourcetype": "crowdstrike:falcon:json",
"process": "explorer.exe",
"ai_score": 0.96,
"extra": {
"DetectId": "ldt:abc123:lockbit-encrypt",
"PatternDispositionDescription": "Prevention, process killed.",
"Severity": 5,
"Tactic": "Impact",
"Technique": "Data Encrypted for Impact",
"FilesModified": 12384,
"FileExtensionWritten": ".lockbit",
"ComputerName": "WIN-FIN-DB01",
"UserName": "svc-backup",
},
},
{
"title": "WinEventLog: SMB lateral connection to FIN-DB02 from WIN-FIN-DB01",
"severity": "high",
"source": "Windows Security",
"category": "siem",
"sourcetype": "WinEventLog:Security",
"process": "lsass.exe",
"ai_score": 0.83,
"extra": {
"EventCode": 4624,
"LogonType": 3,
"TargetUserName": "svc-backup",
"WorkstationName": "WIN-FIN-DB01",
"IpAddress": "10.42.1.87",
"TargetServerName": "FIN-DB02",
"AuthenticationPackageName": "NTLM",
},
},
],
"playbook_run": {
"playbook_id": "ransomware-containment-v3",
"playbook_name": "Ransomware Containment & Eradication",
"status": "running",
"context": {
"incident_severity": "critical",
"host": "WIN-FIN-DB01",
"user": "svc-backup@example.com",
"trigger": "ransomware-encryption-pattern",
},
"steps": [
(
"isolate-host",
"Isolate host via CrowdStrike RTR",
"completed",
{"action": "endpoint.isolate", "target": "WIN-FIN-DB01", "result": "contained", "duration_ms": 4_120},
),
(
"snapshot-disk",
"Capture forensic disk image to S3",
"completed",
{"action": "endpoint.snapshot", "target": "WIN-FIN-DB01", "snapshot_id": "snap-0c7f1aa9", "duration_ms": 96_350},
),
(
"block-c2",
"Block known LockBit C2 ranges on perimeter",
"completed",
{"action": "network.block_ip", "targets": ["203.0.113.42", "198.51.100.71"], "duration_ms": 2_980},
),
(
"kill-encryption-process",
"Kill encryption process on host",
"running",
{"action": "endpoint.kill_process", "process_name": "lockbit.exe", "started_at_offset_s": 240},
),
("rotate-credentials", "Rotate svc-backup credentials in AD + secrets vault", "pending", {}),
("notify-stakeholders", "Open ticket, page incident commander, notify legal", "pending", {}),
],
},
"in_flight_investigation": True,
},
{
"key": "INC-RT-002",
"title": "BEC + wire-fraud chain via OAuth-consent phishing of bob@example.com",
"description": (
"Spear-phishing email impersonating CFO led `bob@example.com` to consent "
"to a malicious OAuth app. Inbox-rule auto-forwarded all CFO threads to an "
"external mailbox; a $250k wire transfer was initiated and reversed by "
"treasury before clearing."
),
"severity": "critical",
"status": "resolved",
"host": "MAC-BOB-LT",
"user": "bob@example.com",
"src_ip": "185.199.108.153",
"tactic_ids": ["TA0001", "TA0006", "TA0040"],
"technique_ids": ["T1566.001", "T1528", "T1657"],
"tags": ["phishing", "bec", "oauth", "finance"],
"alerts": [
{
"title": "Microsoft 365: Add OAuth2PermissionGrant for `Acme Calendar Sync`",
"severity": "high",
"source": "Microsoft 365",
"category": "saas",
"sourcetype": "o365:management:activity",
"process": "AzureActiveDirectory",
"ai_score": 0.91,
"extra": {
"Operation": "Consent to application.",
"ApplicationDisplayName": "Acme Calendar Sync",
"ConsentContext.IsAdminConsent": False,
"ScopeRequested": "Mail.Read Files.Read.All offline_access",
"UserId": "bob@example.com",
"ClientIP": "185.199.108.153",
},
},
{
"title": "Microsoft 365: New-InboxRule auto-forwards CFO threads externally",
"severity": "high",
"source": "Microsoft 365",
"category": "saas",
"sourcetype": "o365:management:activity",
"process": "Exchange",
"ai_score": 0.88,
"extra": {
"Operation": "New-InboxRule",
"Parameters": [
{"Name": "From", "Value": "cfo@example.com"},
{"Name": "ForwardTo", "Value": "treasury-update@gnail-acme.com"},
{"Name": "DeleteMessage", "Value": "True"},
],
"UserId": "bob@example.com",
"ClientIP": "185.199.108.153",
},
},
],
"playbook_run": {
"playbook_id": "bec-response-v2",
"playbook_name": "BEC / Wire-Fraud Response",
"status": "completed",
"context": {
"victim_user": "bob@example.com",
"wire_amount_usd": 250_000,
"wire_status": "recalled",
},
"steps": [
(
"revoke-oauth-grant",
"Revoke malicious OAuth grant",
"completed",
{"action": "saas.revoke_oauth", "app": "Acme Calendar Sync", "duration_ms": 3_400},
),
(
"delete-inbox-rule",
"Delete malicious inbox rule",
"completed",
{"action": "saas.delete_inbox_rule", "duration_ms": 2_100},
),
(
"force-mfa-reset",
"Force MFA + password reset for bob@example.com",
"completed",
{"action": "identity.force_mfa", "duration_ms": 5_780},
),
(
"notify-treasury",
"Notify treasury to recall wire",
"completed",
{"action": "ticket.create", "system": "ServiceNow", "ticket": "INC0019823"},
),
("ioc-share", "Share sender IPs with TIP", "completed", {"action": "tip.share"}),
],
},
},
{
"key": "INC-RT-003",
"title": "Okta credential stuffing → first-success login for alice@example.com",
"description": (
"Okta saw 412 failed logins for `alice@example.com` from 38 distinct IPs in "
"9 minutes (rotating residential proxies), followed by a single successful "
"login + MFA-push approval from a never-seen device."
),
"severity": "high",
"status": "in_progress",
"host": "WIN-HR-DESKTOP",
"user": "alice@example.com",
"src_ip": "45.155.205.88",
"tactic_ids": ["TA0006", "TA0001"],
"technique_ids": ["T1110.004", "T1078.004"],
"tags": ["identity", "credential-stuffing", "okta"],
"alerts": [
{
"title": "Okta: 412 failed logins for alice@example.com in 9 min",
"severity": "high",
"source": "Okta",
"category": "identity",
"sourcetype": "okta:im",
"process": "okta.policy.evaluate_sign_on",
"ai_score": 0.92,
"extra": {
"eventType": "user.session.start",
"outcome": {"result": "FAILURE", "reason": "INVALID_CREDENTIALS"},
"actor": {"alternateId": "alice@example.com"},
"client": {"ipAddress": "45.155.205.88", "userAgent": "Mozilla/5.0"},
"failure_count": 412,
"distinct_ips": 38,
},
},
{
"title": "Okta: first successful login from new device — alice@example.com",
"severity": "high",
"source": "Okta",
"category": "identity",
"sourcetype": "okta:im",
"process": "okta.policy.evaluate_sign_on",
"ai_score": 0.84,
"extra": {
"eventType": "user.session.start",
"outcome": {"result": "SUCCESS"},
"actor": {"alternateId": "alice@example.com"},
"client": {"ipAddress": "45.155.205.88", "device": "Unknown"},
"authenticationContext": {"authenticationStep": 1},
},
},
],
"playbook_run": {
"playbook_id": "account-takeover-v1",
"playbook_name": "Account Takeover Response",
"status": "running",
"context": {"target_user": "alice@example.com"},
"steps": [
(
"suspend-session",
"Suspend Okta session for user",
"completed",
{"action": "identity.suspend_session", "duration_ms": 1_900},
),
("force-mfa", "Force step-up MFA on next login", "completed", {"action": "identity.force_mfa", "duration_ms": 1_200}),
("rotate-app-tokens", "Revoke OAuth refresh tokens", "running", {}),
("alert-user", "Page user for verification", "pending", {}),
],
},
},
{
"key": "INC-RT-004",
"title": "AWS IAM key leak → S3 enumeration + GetObject from external IP",
"description": (
"GuardDuty fired `UnauthorizedAccess:IAMUser/MaliciousIPCaller`. CloudTrail "
"shows the key listing buckets and pulling objects from `corp-hr-backups` "
"from a non-corp IP. Key has been disabled."
),
"severity": "high",
"status": "in_progress",
"host": "ec2-build-worker-09",
"user": "iam-user/build-runner",
"src_ip": "104.244.42.193",
"tactic_ids": ["TA0006", "TA0009", "TA0010"],
"technique_ids": ["T1078.004", "T1530", "T1567.002"],
"tags": ["aws", "cloud", "iam", "s3"],
"alerts": [
{
"title": "AWS GuardDuty: UnauthorizedAccess:IAMUser/MaliciousIPCaller",
"severity": "high",
"source": "AWS GuardDuty",
"category": "cloud",
"sourcetype": "aws:guardduty",
"process": "guardduty.finding",
"ai_score": 0.93,
"extra": {
"type": "UnauthorizedAccess:IAMUser/MaliciousIPCaller",
"severity": 8,
"resource": {"accessKeyDetails": {"userName": "build-runner"}},
"service": {"action": {"awsApiCallAction": {"api": "ListBuckets"}}},
"remoteIpDetails": {"ipAddressV4": "104.244.42.193", "country": {"countryName": "Romania"}},
},
},
{
"title": "CloudTrail: GetObject burst from build-runner — corp-hr-backups",
"severity": "high",
"source": "AWS CloudTrail",
"category": "cloud",
"sourcetype": "aws:cloudtrail",
"process": "s3.amazonaws.com",
"ai_score": 0.87,
"extra": {
"eventName": "GetObject",
"eventSource": "s3.amazonaws.com",
"userIdentity": {"type": "IAMUser", "userName": "build-runner"},
"sourceIPAddress": "104.244.42.193",
"requestParameters": {"bucketName": "corp-hr-backups"},
"object_count_5min": 312,
},
},
],
"playbook_run": {
"playbook_id": "aws-key-compromise-v2",
"playbook_name": "AWS Access-Key Compromise",
"status": "running",
"context": {"iam_user": "build-runner"},
"steps": [
("disable-key", "Deactivate IAM access key", "completed", {"action": "aws.iam.deactivate_key", "duration_ms": 2_900}),
("rotate-key", "Issue replacement key for service", "completed", {"action": "aws.iam.create_key", "duration_ms": 3_400}),
("block-ip", "Add NACL block for malicious IP", "completed", {"action": "aws.nacl.deny", "ip": "104.244.42.193"}),
("audit-bucket-access", "Audit corp-hr-backups access", "running", {}),
],
},
},
{
"key": "INC-RT-005",
"title": "Insider exfil: 12 GB customer-PII upload to personal Drive",
"description": (
"DLP flagged `dave@example.com` zipping 12 GB of customer PII from the HR "
"share and uploading to a personal Google Drive. Egress proxy blocked the "
"second batch; first batch (4.2 GB) reached external."
),
"severity": "high",
"status": "resolved",
"host": "WIN-HR-DESKTOP",
"user": "dave@example.com",
"src_ip": "10.42.7.119",
"tactic_ids": ["TA0009", "TA0010"],
"technique_ids": ["T1005", "T1567.002"],
"tags": ["insider", "dlp", "exfiltration"],
"alerts": [
{
"title": "DLP: 12 GB PII archive uploaded to drive.google.com",
"severity": "high",
"source": "Cloudflare WAF",
"category": "network",
"sourcetype": "cloudflare:dlp",
"process": "chrome.exe",
"ai_score": 0.89,
"extra": {
"policy": "PII-Customer-Records",
"action": "BLOCK",
"user": "dave@example.com",
"source_host": "WIN-HR-DESKTOP",
"destination_host": "drive.google.com",
"bytes_blocked": 8_321_000_000,
"bytes_pre_block": 4_200_000_000,
},
},
],
"playbook_run": {
"playbook_id": "insider-exfil-v1",
"playbook_name": "Insider Exfiltration Containment",
"status": "completed",
"context": {"actor": "dave@example.com"},
"steps": [
("revoke-saas-tokens", "Revoke Google + Slack tokens", "completed", {"duration_ms": 4_300}),
("disable-account", "Disable AD + Okta accounts", "completed", {"duration_ms": 6_800}),
("preserve-evidence", "Capture endpoint forensic image", "completed", {"duration_ms": 145_000}),
("notify-hr-legal", "Notify HR + outside counsel", "completed", {"duration_ms": 800}),
("dlp-rule-tighten", "Tighten DLP egress rules for PII", "completed", {"duration_ms": 2_400}),
],
},
},
{
"key": "INC-RT-006",
"title": "Compromised npm package `event-stream-helper` — reverse shell from CI runner",
"description": (
"Build pipeline on `LIN-K8S-NODE-03` installed `event-stream-helper@2.0.4` "
"whose post-install hook spawned a reverse shell to 5.39.222.7. The package "
"was unpublished from the registry 18 minutes after install."
),
"severity": "high",
"status": "in_progress",
"host": "LIN-K8S-NODE-03",
"user": "ci-runner",
"src_ip": "5.39.222.7",
"tactic_ids": ["TA0001", "TA0002", "TA0011"],
"technique_ids": ["T1195.002", "T1059.004", "T1071.001"],
"tags": ["supply-chain", "npm", "ci"],
"alerts": [
{
"title": "auditd: bash -i reverse shell spawned from npm post-install",
"severity": "high",
"source": "Suricata IDS",
"category": "edr",
"sourcetype": "linux:auditd",
"process": "/bin/bash",
"ai_score": 0.94,
"extra": {
"type": "EXECVE",
"exe": "/bin/bash",
"argv": ["bash", "-i"],
"ppid_exe": "/usr/bin/node",
"ppid_argv": ["node", "/app/node_modules/event-stream-helper/postinstall.js"],
"uid": 1001,
"auid": 1001,
},
},
{
"title": "Suricata: outbound TCP 4444 to 5.39.222.7 from LIN-K8S-NODE-03",
"severity": "high",
"source": "Suricata IDS",
"category": "network",
"sourcetype": "suricata:alert",
"process": "node",
"ai_score": 0.86,
"extra": {
"alert": {
"signature": "ET POLICY Possible reverse shell to 5.39.222.7",
"category": "Potentially Bad Traffic",
"severity": 1,
},
"src_ip": "10.0.4.91",
"dest_ip": "5.39.222.7",
"dest_port": 4444,
"proto": "TCP",
},
},
],
"playbook_run": {
"playbook_id": "supply-chain-npm-v1",
"playbook_name": "Supply-Chain (npm) Containment",
"status": "running",
"context": {"package": "event-stream-helper@2.0.4"},
"steps": [
("kill-runner-pods", "Cordon + drain affected K8s pods", "completed", {"duration_ms": 12_400}),
("block-c2", "Block 5.39.222.7 at egress firewall", "completed", {"duration_ms": 2_500}),
("pin-deps", "Pin lockfile to last-known-good", "running", {}),
("scan-other-builds", "Scan last 14d builds for the package", "pending", {}),
],
},
},
{
"key": "INC-RT-007",
"title": "Cobalt Strike beacon + DNS C2 from WIN-DEVOPS-LT",
"description": (
"Suricata flagged a CS Malleable C2 profile on outbound traffic, while "
"Sysmon recorded process injection (svchost ↔ rundll32) and DNS queries "
"with TXT-record payloads to `azonly-cdn.io`."
),
"severity": "critical",
"status": "in_progress",
"host": "WIN-DEVOPS-LT",
"user": "carol@example.com",
"src_ip": "10.0.5.27",
"tactic_ids": ["TA0005", "TA0011"],
"technique_ids": ["T1055.012", "T1071.004"],
"tags": ["cobalt-strike", "c2", "dns"],
"alerts": [
{
"title": "Suricata: ET TROJAN Cobalt Strike Malleable C2 profile",
"severity": "critical",
"source": "Suricata IDS",
"category": "network",
"sourcetype": "suricata:alert",
"process": "rundll32.exe",
"ai_score": 0.95,
"extra": {
"alert": {
"signature": "ET TROJAN Observed CobaltStrike Malleable C2 (Profile)",
"category": "Trojan Activity",
"severity": 1,
},
"src_ip": "10.0.5.27",
"dest_ip": "23.106.222.74",
"dest_port": 443,
"proto": "TCP",
},
},
{
"title": "Sysmon: process-injection from svchost.exe to rundll32.exe",
"severity": "critical",
"source": "Microsoft Sysmon",
"category": "edr",
"sourcetype": "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational",
"process": "svchost.exe",
"ai_score": 0.91,
"extra": {
"EventID": 8, # CreateRemoteThread
"SourceImage": r"C:\Windows\System32\svchost.exe",
"TargetImage": r"C:\Windows\System32\rundll32.exe",
"TargetProcessId": 6712,
},
},
{
"title": "DNS: 220 TXT-record queries to azonly-cdn.io in 60s",
"severity": "high",
"source": "Suricata IDS",
"category": "network",
"sourcetype": "dns:bro",
"process": "rundll32.exe",
"ai_score": 0.81,
"extra": {
"qname": "azonly-cdn.io",
"qtype_name": "TXT",
"qcount": 220,
"answers_avg_len": 248,
},
},
],
"playbook_run": {
"playbook_id": "c2-containment-v1",
"playbook_name": "C2 Beacon Containment",
"status": "running",
"context": {"host": "WIN-DEVOPS-LT", "framework": "cobalt-strike"},
"steps": [
("isolate-host", "Isolate host via Defender", "completed", {"action": "endpoint.isolate", "duration_ms": 3_900}),
("block-c2-ip", "Block 23.106.222.74", "completed", {"duration_ms": 1_700}),
("dns-sinkhole", "Sinkhole azonly-cdn.io", "running", {}),
("memory-capture", "Capture memory image for analysis", "pending", {}),
],
},
},
{
"key": "INC-RT-008",
"title": "Kerberoasting + DCSync attempt from WIN-DEVOPS-LT against DC01",
"description": (
"Bulk TGS-REQ for SPNs with weak crypto, followed by an attempted "
"DCSync (DRSReplicaSync) call from a non-DC host. Domain controller "
"rejected the call but the attempt is high-confidence."
),
"severity": "critical",
"status": "open",
"host": "WIN-DEVOPS-LT",
"user": "carol@example.com",
"src_ip": "10.0.5.27",
"tactic_ids": ["TA0006", "TA0004"],
"technique_ids": ["T1558.003", "T1003.006"],
"tags": ["ad", "kerberoast", "dcsync"],
"alerts": [
{
"title": "WinEventLog: 87 Kerberos TGS requests (RC4) in 2 min",
"severity": "high",
"source": "Windows Security",
"category": "siem",
"sourcetype": "WinEventLog:Security",
"process": "lsass.exe",
"ai_score": 0.88,
"extra": {
"EventCode": 4769,
"TicketEncryptionType": "0x17",
"ServiceName": "MSSQLSvc/finance-db.corp.example.com",
"TargetUserName": "carol@example.com",
"request_count": 87,
},
},
{
"title": "WinEventLog: DRSReplicaSync from non-DC host WIN-DEVOPS-LT",
"severity": "critical",
"source": "Windows Security",
"category": "siem",
"sourcetype": "WinEventLog:Security",
"process": "lsass.exe",
"ai_score": 0.96,
"extra": {
"EventCode": 4662,
"Properties": "{1131f6aa-9c07-11d1-f79f-00c04fc2dcd2}", # DS-Replication-Get-Changes
"AccessMask": "0x100",
"WorkstationName": "WIN-DEVOPS-LT",
"TargetServer": "DC01.corp.example.com",
},
},
],
},
{
"key": "INC-RT-009",
"title": "OAuth-consent phishing of carol@example.com (Microsoft 365)",
"description": (
"Malicious app `Internal IT Support` requested Mail.ReadWrite + "
"Files.Read.All. Consent was granted then revoked; mailbox audit shows no "
"downloads, but creator inbox-rule was added."
),
"severity": "medium",
"status": "resolved",
"host": "MAC-CAROL-LT",
"user": "carol@example.com",
"src_ip": "192.0.2.55",
"tactic_ids": ["TA0001", "TA0006"],
"technique_ids": ["T1528"],
"tags": ["oauth", "phishing", "m365"],
"alerts": [
{
"title": "M365: Consent to OAuth app `Internal IT Support`",
"severity": "medium",
"source": "Microsoft 365",
"category": "saas",
"sourcetype": "o365:management:activity",
"process": "AzureActiveDirectory",
"ai_score": 0.74,
"extra": {
"Operation": "Consent to application.",
"ApplicationDisplayName": "Internal IT Support",
"ScopeRequested": "Mail.ReadWrite Files.Read.All offline_access",
"UserId": "carol@example.com",
"ClientIP": "192.0.2.55",
},
},
],
"playbook_run": {
"playbook_id": "oauth-consent-phish-v1",
"playbook_name": "OAuth Consent-Phish Response",
"status": "completed",
"context": {"app": "Internal IT Support"},
"steps": [
("revoke-consent", "Revoke OAuth grant", "completed", {"duration_ms": 2_500}),
("audit-mailbox", "Audit mailbox activity", "completed", {"duration_ms": 8_400}),
("delete-inbox-rule", "Delete inbox rule", "completed", {"duration_ms": 1_300}),
],
},
},
{
"key": "INC-RT-010",
"title": "Privileged container escape on LIN-K8S-NODE-03",
"description": (
"A pod created with `privileged: true, hostPID: true` mounted /proc and "
"wrote to `/proc/sys/kernel/core_pattern` to gain code-execution as root "
"on the node. Detected by Falco, validated via kube-audit + auditd."
),
"severity": "critical",
"status": "in_progress",
"host": "LIN-K8S-NODE-03",
"user": "system:serviceaccount:dev:builder-sa",
"src_ip": "10.0.4.91",
"tactic_ids": ["TA0004", "TA0007"],
"technique_ids": ["T1611", "T1082"],
"tags": ["k8s", "container-escape", "privesc"],
"alerts": [
{
"title": "kube-audit: privileged pod created in dev namespace",
"severity": "high",
"source": "Suricata IDS",
"category": "cloud",
"sourcetype": "kube:audit",
"process": "kube-apiserver",
"ai_score": 0.85,
"extra": {
"verb": "create",
"objectRef": {"resource": "pods", "namespace": "dev", "name": "build-runner-x9k"},
"user": {"username": "system:serviceaccount:dev:builder-sa"},
"requestObject": {"spec": {"hostPID": True, "containers": [{"securityContext": {"privileged": True}}]}},
},
},
{
"title": "auditd: write to /proc/sys/kernel/core_pattern from container",
"severity": "critical",
"source": "Suricata IDS",
"category": "edr",
"sourcetype": "linux:auditd",
"process": "/bin/sh",
"ai_score": 0.93,
"extra": {
"type": "PATH",
"name": "/proc/sys/kernel/core_pattern",
"exe": "/bin/sh",
"auid": 0,
},
},
],
"playbook_run": {
"playbook_id": "container-escape-v1",
"playbook_name": "Container Escape Containment",
"status": "running",
"context": {"namespace": "dev", "pod": "build-runner-x9k"},
"steps": [
("delete-pod", "Delete offending pod", "completed", {"duration_ms": 1_400}),
("cordon-node", "Cordon LIN-K8S-NODE-03", "completed", {"duration_ms": 1_900}),
("rotate-sa-tokens", "Rotate builder-sa token", "running", {}),
("psp-tighten", "Apply PSA `restricted` to dev namespace", "pending", {}),
],
},
},
{
"key": "INC-RT-011",
"title": "DNS tunnelling exfil from MAC-SARAH-LT (~180 MB over 2 h)",
"description": (
"DNS query volume from `MAC-SARAH-LT` rose to 50× baseline with high-"
"entropy subdomains under `nsdata.io`. Approximate base64 payload size: "
"180 MB. Matches dnscat2 behaviour."
),
"severity": "high",
"status": "in_progress",
"host": "MAC-SARAH-LT",
"user": "sarah@example.com",