Builds real-time incident response dashboards in Splunk, Elastic Kibana, or Grafana for SOC analysts to track affected systems, containment status, IOC spread, and response timelines during IR coordination and reporting.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
在以下情况使用本技能：
Builds real-time incident response dashboards in Splunk, Elastic, or Grafana for SOC analysts tracking affected systems, containment status, IOC spread, and response timeline during active incidents.
Builds real-time incident response dashboards in Splunk, Elastic, or Grafana for SOC analysts to track affected systems, containment status, IOC spread, and timelines during active incidents.
Builds SOC metrics and KPI tracking dashboards from SIEM data, measuring MTTD, MTTR, alert quality ratio, analyst productivity, and detection coverage. For SOC leaders needing operational visualization and reports.
Share bugs, ideas, or general feedback.
在以下情况使用本技能：
不适用于日常 SOC 监控仪表盘（应使用事件审查功能）——IR 仪表盘专为主动事件协调和管理报告而设计。
构建 Splunk Dashboard Studio 仪表盘用于主动事件跟踪：
<dashboard version="2" theme="dark">
<label>主动事件响应仪表盘</label>
<description>IR-2024-0450 实时跟踪</description>
<row>
<panel>
<title>事件摘要</title>
<single>
<search>
<query>
| makeresults
| eval incident_id="IR-2024-0450",
status="CONTAINMENT",
severity="Critical",
affected_hosts=7,
contained_hosts=5,
iocs_identified=23,
hours_elapsed=round((now()-strptime("2024-03-15 14:00","%Y-%m-%d %H:%M"))/3600,1)
| table incident_id, status, severity, affected_hosts, contained_hosts, iocs_identified, hours_elapsed
</query>
</search>
</single>
</panel>
</row>
</dashboard>
跟踪受影响系统及其遏制状态：
| inputlookup ir_affected_systems.csv
| eval status_color = case(
status="Contained", "#2ecc71",
status="Compromised", "#e74c3c",
status="Investigating", "#f39c12",
status="Recovered", "#3498db",
1=1, "#95a5a6"
)
| stats count by status
| eval order = case(status="Compromised", 1, status="Investigating", 2,
status="Contained", 3, status="Recovered", 4)
| sort order
| table status, count
--- 详细主机表
| inputlookup ir_affected_systems.csv
| lookup asset_lookup_by_cidr ip AS host_ip OUTPUT category, owner, priority
| table hostname, host_ip, category, owner, status, containment_time,
compromise_vector, analyst_assigned
| sort status, hostname
监控 IOC 在环境中的扩散：
--- 事件期间识别的 IOC
index=* (src_ip IN ("185.234.218.50", "45.77.123.45") OR
dest IN ("evil-c2.com", "malware-drop.com") OR
file_hash IN ("a1b2c3d4...", "e5f6a7b8..."))
earliest="2024-03-14"
| stats count AS hits, dc(src_ip) AS unique_sources,
dc(dest) AS unique_dests, latest(_time) AS last_seen
by sourcetype
| sort - hits
--- IOC 时间线
index=* (src_ip IN ("185.234.218.50") OR dest="evil-c2.com")
earliest="2024-03-14"
| timechart span=1h count by sourcetype
--- 新 IOC 发现跟踪
| inputlookup ir_ioc_list.csv
| stats count by ioc_type, source, discovery_time
| sort discovery_time
| table discovery_time, ioc_type, ioc_value, source, status
创建按时间顺序排列的事件时间线：
| inputlookup ir_timeline.csv
| sort _time
| eval phase = case(
action_type="detection", "检测（Detection）",
action_type="triage", "分诊（Triage）",
action_type="containment", "遏制（Containment）",
action_type="eradication", "根除（Eradication）",
action_type="recovery", "恢复（Recovery）",
1=1, "其他"
)
| eval phase_color = case(
phase="检测（Detection）", "#e74c3c",
phase="分诊（Triage）", "#f39c12",
phase="遏制（Containment）", "#e67e22",
phase="根除（Eradication）", "#2ecc71",
phase="恢复（Recovery）", "#3498db"
)
| table _time, phase, action, analyst, details
时间线数据示例：
_time,action_type,action,analyst,details
2024-03-15 14:00,detection,Alert triggered - Cobalt Strike beacon detected,splunk_es,Notable event NE-2024-08921
2024-03-15 14:12,triage,Alert triaged - confirmed true positive,analyst_jdoe,VT score 52/72 on beacon hash
2024-03-15 14:23,containment,Host WORKSTATION-042 isolated,analyst_jdoe,CrowdStrike network isolation
2024-03-15 14:35,containment,C2 domain blocked on firewall,analyst_msmith,Palo Alto rule deployed
2024-03-15 15:00,eradication,Enterprise-wide IOC scan initiated,analyst_jdoe,Splunk search across all indices
2024-03-15 15:30,containment,3 additional hosts identified and isolated,analyst_msmith,Lateral movement confirmed
2024-03-15 16:00,eradication,Malware removed from all affected hosts,analyst_tier3,CrowdStrike RTR cleanup
2024-03-15 18:00,recovery,Systems restored and monitored,analyst_msmith,72-hour monitoring period started
跟踪整体 SOC 性能指标：
--- 按严重性划分的事件量（过去 30 天）
index=notable earliest=-30d
| stats count by urgency
| eval order = case(urgency="critical", 1, urgency="high", 2, urgency="medium", 3,
urgency="low", 4, urgency="informational", 5)
| sort order
--- 平均检测时间（MTTD）
index=notable earliest=-30d status_label="Resolved*"
| eval mttd_minutes = round((time_of_first_event - orig_time) / 60, 1)
| stats avg(mttd_minutes) AS avg_mttd, median(mttd_minutes) AS med_mttd,
perc95(mttd_minutes) AS p95_mttd
--- 平均响应时间（MTTR）
index=notable earliest=-30d status_label="Resolved*"
| eval mttr_hours = round((status_end - _time) / 3600, 1)
| stats avg(mttr_hours) AS avg_mttr, median(mttr_hours) AS med_mttr by urgency
--- 分析师工作负载分布
index=notable earliest=-7d
| stats count by owner
| sort - count
--- 告警处置分类
index=notable earliest=-30d status_label IN ("Resolved*", "Closed*")
| stats count by disposition
| eval percentage = round(count / sum(count) * 100, 1)
| sort - count
在重大事件期间为领导层创建高级别仪表盘：
--- 高管摘要面板
| makeresults
| eval metrics = "业务影响：1 台文件服务器离线（财务部门），"
."预计恢复：4 小时，"
."数据丢失风险：低（备份已验证），"
."客户影响：无，"
."监管通知：不需要（未确认 PII 暴露）"
--- 趋势对比（本月与上月）
index=notable earliest=-60d
| eval period = if(_time > relative_time(now(), "-30d"), "本月", "上月")
| stats count by period, urgency
| chart sum(count) AS incidents by period, urgency
--- 主要威胁类别
index=notable earliest=-30d
| top rule_name limit=10
| table rule_name, count, percent
使用 Splunk 计划搜索维护仪表盘数据：
--- 计划搜索：更新受影响系统查找表（每 5 分钟运行一次）
index=* (src_ip IN [| inputlookup ir_ioc_list.csv | search ioc_type="ip"
| fields ioc_value | rename ioc_value AS src_ip])
earliest=-1h
| stats latest(_time) AS last_seen, count AS event_count,
values(sourcetype) AS data_sources by src_ip
| eval status = if(last_seen > relative_time(now(), "-15m"), "Active", "Dormant")
| outputlookup ir_affected_systems_auto.csv
| 术语 | 定义 |
|---|---|
| 态势感知（Situational Awareness） | 实时了解事件范围、受影响系统和响应进展 |
| MTTD | 平均检测时间（Mean Time to Detect）——从威胁发生到 SOC 告警生成的平均时间 |
| MTTR | 平均响应时间（Mean Time to Respond）——从告警到事件解决或遏制的平均时间 |
| 遏制率（Containment Rate） | 相对于已被攻陷的系统总数，成功隔离的受影响系统百分比 |
| 燃尽图（Burn-Down Chart） | 事件期间随时间推移跟踪剩余未完成调查任务的可视化图表 |
| 高管汇报（Executive Briefing） | 显示业务影响、时间线和恢复状态的非技术性摘要仪表盘 |
事件响应仪表盘 — IR-2024-0450
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
状态：遏制阶段（已历时 6 小时 30 分钟）
受影响系统: 遏制进度:
已攻陷： 2 [==========----------] 71%
调查中： 1 7 个系统中已遏制 5 个
已遏制： 3
已恢复： 1
IOC 摘要： 响应时间线：
IP： 4 14:00 — 触发告警
域名： 2 14:12 — 确认恶意
哈希： 3 14:23 — 第一台主机隔离
URL： 5 15:00 — 启动企业扫描
邮件： 1 15:30 — 又隔离 3 台主机
关键指标：
MTTD: 12 分钟
MTTC: 23 分钟（第一台主机）
在职分析师：3 人（Tier 2：2 人，Tier 3：1 人）
业务影响：低 — 财务文件服务器离线，无面向客户的系统受影响