Triages security incidents using IR playbooks: classifies alerts from SIEM/EDR, enriches IOCs with threat intel APIs, scores severity via matrix, assigns teams, starts responses. For SOC handling new alerts.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
- 从 SIEM、EDR 或其他检测来源收到新的安全告警
Triages security incidents from SIEM/EDR using IR playbooks: enriches alerts, classifies types, sets severity, assigns teams, starts responses. For SOC analysts validating alerts.
Classifies and prioritizes security incidents using IR playbooks to assess severity, assign teams, and launch responses. For SOC analysts triaging SIEM/EDR alerts with enrichment via threat intel.
Triages security incidents using NIST SP 800-61r3 and SANS PICERL: classifies types, assesses severity by business impact and asset criticality, determines response actions, and routes to teams. For SOC alert prioritization and initial analysis.
Share bugs, ideas, or general feedback.
# 查询 Splunk 中新的严重/高级告警
index=notable status=new severity IN ("critical","high")
| table _time, rule_name, src, dest, severity, description
| sort -_time
# 查询 TheHive 中的新案例
curl -s -H "Authorization: Bearer $THEHIVE_API_KEY" \
"https://thehive.local/api/v1/query?name=list-alerts" \
-H "Content-Type: application/json" \
-d '{"query":[{"_name":"listAlert"},{"_name":"filter","_field":"status","_value":"New"}]}'
# 在 SIEM 中确认告警，防止重复分类
curl -X POST "https://splunk.local:8089/services/notable_update" \
-H "Authorization: Bearer $SPLUNK_TOKEN" \
-d "ruleUIDs=$RULE_UID&status=1&comment=Triage+initiated+by+analyst"
# 用 VirusTotal 丰富源 IP 信息
curl -s "https://www.virustotal.com/api/v3/ip_addresses/$SRC_IP" \
-H "x-apikey: $VT_API_KEY" | jq '.data.attributes.last_analysis_stats'
# 用 AbuseIPDB 检查 IP 声誉
curl -s "https://api.abuseipdb.com/api/v2/check?ipAddress=$SRC_IP&maxAgeInDays=90" \
-H "Key: $ABUSEIPDB_KEY" -H "Accept: application/json" | jq '.data'
# 用威胁情报丰富文件哈希信息
curl -s "https://www.virustotal.com/api/v3/files/$FILE_HASH" \
-H "x-apikey: $VT_API_KEY" | jq '.data.attributes.last_analysis_stats'
# 查询内部资产数据库获取受影响系统信息
curl -s "https://cmdb.local/api/assets?ip=$DEST_IP" \
-H "Authorization: Bearer $CMDB_TOKEN" | jq '.asset_criticality, .owner, .environment'
# 使用 Playbook 映射表将告警归入事件类别
# 类别：恶意软件、网络钓鱼、未授权访问、数据外泄、
# DoS/DDoS、内部威胁、勒索软件、账号攻陷、Web 攻击
# 检查告警是否匹配已知 Playbook 触发条件
grep -i "$ALERT_SIGNATURE" /opt/ir/playbooks/trigger_conditions.yaml
# 根据 MITRE ATT&CK 技术确定事件类型
curl -s "https://attack.mitre.org/api/techniques/$TECHNIQUE_ID" | jq '.name, .tactic'
# 严重性矩阵影响因素：
# 1. 资产重要性（关键/高/中/低）
# 2. 数据敏感性（PII/PHI/PCI/机密/公开）
# 3. 受影响系统数量
# 4. 活跃威胁还是历史威胁
# 5. 已确认还是疑似攻陷
# 自动化严重性计算
python3 -c "
severity_score = 0
# 资产重要性：关键=4, 高=3, 中=2, 低=1
severity_score += 4 # 关键服务器
# 数据敏感性：PII/PHI=4, PCI=3, 机密=2, 公开=1
severity_score += 3 # PCI 数据
# 范围：企业级=4, 部门级=3, 单系统=2, 单用户=1
severity_score += 2 # 单系统
# 威胁状态：活跃=4, 近期=3, 历史=2, 潜在=1
severity_score += 4 # 活跃威胁
if severity_score >= 12: print('严重 - P1')
elif severity_score >= 9: print('高 - P2')
elif severity_score >= 6: print('中 - P3')
else: print('低 - P4')
print(f'得分: {severity_score}/16')
"
# 根据事件类型加载对应 Playbook
cat /opt/ir/playbooks/ransomware_playbook.yaml
cat /opt/ir/playbooks/phishing_playbook.yaml
cat /opt/ir/playbooks/unauthorized_access_playbook.yaml
# 在 TheHive 中创建事件工单
curl -X POST "https://thehive.local/api/v1/case" \
-H "Authorization: Bearer $THEHIVE_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"title": "IR-2024-XXX: [事件类型] - [简要描述]",
"description": "分类摘要和初始发现",
"severity": 3,
"tlp": 2,
"pap": 2,
"tags": ["ransomware", "triage-complete"],
"customFields": {
"playbook": {"string": "ransomware_v2"},
"affected_systems": {"integer": 5}
}
}'
# 检查值班排班
curl -s "https://pagerduty.com/api/v2/oncalls?schedule_ids[]=$SCHEDULE_ID" \
-H "Authorization: Token token=$PD_TOKEN" | jq '.oncalls[].user.summary'
# 根据严重性通知事件响应人员
# P1/严重：通知 IR 负责人 + 高级分析员 + CISO
# P2/高：通知 IR 负责人 + 可用分析员
# P3/中：分配给下一位可用分析员
# P4/低：排入工作时间处理队列
curl -X POST "https://events.pagerduty.com/v2/enqueue" \
-H "Content-Type: application/json" \
-d '{
"routing_key": "'$PD_ROUTING_KEY'",
"event_action": "trigger",
"payload": {
"summary": "P1 安全事件：在 PROD-DB-01 上检测到勒索软件",
"severity": "critical",
"source": "SIEM-Splunk",
"custom_details": {"incident_id": "IR-2024-042", "playbook": "ransomware_v2"}
}
}'
# 用分类摘要更新事件工单
curl -X PATCH "https://thehive.local/api/v1/case/$CASE_ID" \
-H "Authorization: Bearer $THEHIVE_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"status": "InProgress",
"customFields": {
"triage_analyst": {"string": "analyst_name"},
"triage_time": {"date": '$(date +%s000)'},
"severity_justification": {"string": "关键资产 + 活跃威胁 + PCI 数据"}
}
}'
| 概念 | 定义 |
|---|---|
| 真阳性（True Positive） | 告警正确识别了真实安全事件 |
| 假阳性（False Positive） | 告警错误地将正常活动标记为恶意 |
| 严重性分类（Severity Classification） | 根据影响和紧迫性对事件优先级进行排名 |
| Playbook 选择（Playbook Selection） | 根据事件类型选择适当的响应程序 |
| IOC 丰富化（IOC Enrichment） | 从威胁情报来源为指标添加上下文信息 |
| 升级阈值（Escalation Threshold） | 触发升级至更高严重性或管理层的条件 |
| 分类 SLA（Triage SLA） | 初始评估的时间目标（关键事件通常为 15-30 分钟） |
| 工具 | 用途 |
|---|---|
| Splunk/Elastic/QRadar | SIEM 告警关联与查询 |
| TheHive/SIRP | 事件案例管理和 Playbook 追踪 |
| VirusTotal/AbuseIPDB | IOC 声誉查询和丰富化 |
| PagerDuty/OpsGenie | 值班管理和告警通知 |
| MITRE ATT&CK | 技术分类与映射 |
| Cortex XSOAR | 用于自动化分类工作流的 SOAR 平台 |