CSOC Operations & Playbook Automation

CSOC 运维与手册自动化

用途

帮助 Claude 为网络安全运营中心（CSOC）团队提供支持，包括结构化告警分类、自动化手册创建、升级工作流设计、交接班报告以及 SOC 指标分析。Claude 会生成可供分析师直接执行或调整后用于其 SOAR 平台的运维材料。

---

激活条件

用户询问以下内容时激活此技能：

• 对 SIEM 告警或安全事件进行分类
• 为 SOC 分析师创建事件响应手册
• 设计升级工作流和通知链
• 生成 SOC 交接班报告
• 计算 SOC 指标（MTTD、MTTR、FPR）
• 自动化重复性 SOC 任务
• 将手册转换为 Splunk SOAR、Palo Alto XSOAR 或 ServiceNow 格式
• SOC 分析师决策支持和运行手册
• 降低告警疲劳的策略
• 告警关联和去重

---

前置条件

pip install pyyaml jinja2 requests python-dateutil

平台集成：

• Splunk SOAR — 手册自动化
• Palo Alto XSOAR — SOAR 平台
• TheHive — 开源 IR 平台
• ServiceNow — ITSM 工单系统
• PagerDuty / OpsGenie — 告警和待命

---

核心功能

1. 告警分类自动化

当用户提供 SIEM 告警并要求进行分类时：

分类决策框架：

Step 1: Parse alert data
  - Source: SIEM, EDR, WAF, IDS, email security, cloud audit logs
  - Extract: timestamp, source IP, destination, user, process, alert type

Step 2: Asset criticality lookup
  - Is the asset business-critical? (production DB, domain controller, payment system)
  - Is the user privileged? (admin, developer, finance)
  - What is the asset's network exposure?

Step 3: Threat context enrichment
  - IP reputation: Check against blocklists (AbuseIPDB, VirusTotal, Shodan)
  - Hash reputation: VirusTotal lookup for file hashes
  - Domain reputation: Phishtank, URLhaus, MX Toolbox
  - User risk score: Recent activity anomalies, recent password resets

Step 4: Apply triage matrix

告警分类矩阵：

告警置信度	资产重要性	建议操作	SLA
高	严重	立即升级至 Tier 2/3 — 宣布发生事件	15 分钟
高	高	Tier 1 优先调查	30 分钟
高	中	Tier 1 常规调查	1 小时
高	低	Tier 1 常规队列	4 小时
中	严重	Tier 1 优先调查	30 分钟
中	高	Tier 1 常规调查	2 小时
中	低	常规队列，若出现模式则进行调查	8 小时
低	任意	自动关闭并记录文档和备注	24 小时

分类分析输出格式：

## Alert Triage Summary

**Alert ID:** [ID]
**Alert Type:** [Type — e.g., Brute Force Login]
**Source:** [Source IP/User/Host]
**Time:** [UTC timestamp]
**SIEM Rule:** [Rule name that triggered]

**Asset Assessment:**
- Asset: [Hostname/IP]
- Criticality: [Critical / High / Medium / Low]
- Role: [e.g., Production Database Server]

**Threat Context:**
- Source IP Reputation: [Malicious / Suspicious / Clean / Unknown]
- Source IP Location: [Country, ASN]
- Known threat actor: [Yes/No — if yes, attribution]
- Related IOCs found: [Yes/No]

**Verdict:** [True Positive / False Positive / Undetermined]
**Triage Action:** [Escalate to Tier 2 / Investigate / Close / Watch]
**Recommended Playbook:** [Playbook name]
**Priority:** [P1 Critical / P2 High / P3 Medium / P4 Low]

**Analyst Notes:**
[Notes from triage]

# Automated triage with script
python scripts/alert_triager.py --alerts alerts.json --output triage_results.json
python scripts/alert_triager.py --alerts siem_export.csv --playbook default --auto-assign

2. 事件响应手册创建

当用户要求创建 SOC 手册时：

手册 YAML 模板（兼容 SOAR）：

# CSOC Playbook: Phishing Email Response
# Compatible with: Splunk SOAR, XSOAR, TheHive
# Last updated: 2025-05-28

name: phishing_email_response
version: "2.0"
trigger:
  alert_types:
    - "Email Security - Phishing Detected"
    - "User Reported Phishing"
  severity: [medium, high, critical]

variables:
  - name: sender_email
    type: string
  - name: recipient_email
    type: string
  - name: email_subject
    type: string
  - name: attachment_hash
    type: string
    required: false

tasks:
  - id: "1-extract-artifacts"
    name: "Extract Email Artifacts"
    type: automated
    actions:
      - Extract sender, recipients, subject, body, attachments
      - Defang all URLs and IPs found in email body
      - Calculate SHA256 of all attachments
      - Extract email headers (SPF, DKIM, DMARC results)
    output:
      - sender_ip
      - sender_domain
      - urls_in_body
      - attachment_hashes

  - id: "2-enrich-indicators"
    name: "Enrich IOCs with Threat Intelligence"
    type: automated
    depends_on: ["1-extract-artifacts"]
    actions:
      - VirusTotal lookup: sender_ip, attachment_hashes, urls_in_body
      - URLhaus lookup: all URLs
      - AbuseIPDB lookup: sender_ip
      - Check internal blocklists
    output:
      - vt_results
      - url_classification
      - ip_reputation

  - id: "3-assess-impact"
    name: "Assess Who Clicked / Opened Attachment"
    type: manual
    depends_on: ["2-enrich-indicators"]
    analyst_actions:
      - "Check email security gateway: did anyone click the link?"
      - "Check proxy logs: any traffic to phishing domain?"
      - "Check EDR: any process execution from attachment?"
    decision_point:
      - condition: "User clicked link OR opened attachment"
        action: escalate_to_incident
      - condition: "No user interaction confirmed"
        action: continue_to_containment

  - id: "4-contain"
    name: "Email and Infrastructure Containment"
    type: hybrid
    actions:
      - Block sender domain in email gateway
      - Block phishing URLs in web proxy and DNS
      - Block attachment hash in EDR/AV
      - Pull email from all mailboxes (if email platform supports)
      - If user clicked: isolate endpoint (→ IR Playbook)

  - id: "5-notify"
    name: "User and Management Notification"
    type: automated
    templates:
      user_notification: |
        Subject: Action Required — Phishing Email in Your Inbox
        You recently received a phishing email (Subject: {{email_subject}}).
        If you clicked any links or opened attachments, please contact the SOC immediately.
        Contact: [email protected] | x4444
      management_notification: |
        CSOC Alert: Phishing campaign targeting [department] detected.
        [N] employees received the email. Status: [contained/investigating].

  - id: "6-close"
    name: "Close and Document"
    type: manual
    actions:
      - Document all IOCs in MISP/threat intel platform
      - Update email security rules
      - Create security awareness notification if targeted campaign
      - Complete incident ticket with findings
    metrics:
      - alert_received_time
      - triage_completed_time
      - contained_time

支持的手册类型及触发条件：

手册	触发条件
网络钓鱼响应	电子邮件安全告警、用户报告
勒索软件响应	大量文件加密、EDR 行为告警
数据外泄	DLP 告警、大量出站传输
暴力破解	在 M 分钟内出现 N 次登录失败
内部威胁	DLP、异常访问模式、人力资源标记
账户入侵	不可能的旅行、新设备登录
恶意软件告警	AV/EDR 告警、检测到电子邮件附件
DDoS 响应	流量量激增、服务降级
未授权访问	访问受限资源
检测到漏洞	扫描器发现、匹配威胁情报

3. 升级工作流设计

当用户要求设计升级工作流时：

## CSOC Escalation Workflow

### Severity Definitions
| Level | CVSS / Impact | Response Time | Team |
|-------|--------------|---------------|------|
| P1 — Critical | 9.0–10.0 or system breach | 15 minutes | Tier 3 + IR Lead + Management |
| P2 — High | 7.0–8.9 or data at risk | 30 minutes | Tier 2 + Tier 3 standby |
| P3 — Medium | 4.0–6.9 | 2 hours | Tier 1 → Tier 2 if unresolved |
| P4 — Low | 0.1–3.9 | 8 hours | Tier 1 |

### Escalation Paths

P1 Incident: Tier 1 Analyst → [immediately] → Tier 3 Lead (call) Tier 3 Lead → [within 5 min] → SOC Manager (call) SOC Manager → [within 15 min] → CISO + Legal (if data breach)

P2 Incident: Tier 1 Analyst → [after 30 min unresolved] → Tier 2 Analyst (ticket escalation) Tier 2 Analyst → [after 2 hours unresolved] → Tier 3 Lead (chat notification)

Out-of-hours escalation: On-call Tier 2 via PagerDuty → 15 min acknowledge → escalate to Tier 3

### Notification Templates

**Slack Critical Alert Template:**

🚨 P1 SECURITY INCIDENT DECLARED 🚨 Type: {{incident_type}} Affected: {{affected_systems}} Time Detected: {{detection_time}} UTC IR Lead: @{{ir_lead}} Bridge: [link to war room] Ticket: {{ticket_id}} ACTION REQUIRED: All IR team members join the bridge now.

**Email Escalation Template:**

Subject: [P{{severity}}] Security Incident — {{incident_type}} — {{ticket_id}}

CSOC has declared a security incident.

Incident ID: {{ticket_id}} Type: {{incident_type}} Severity: {{severity}} Detected: {{detection_time}} UTC Current Status: {{status}} Affected Systems: {{affected_systems}}

Current Actions: {{current_actions}}

Required Actions: {{required_actions}}

Next Update: {{next_update_time}}

SOC Contact: [email protected] | +1-555-SOC-HELP

### 4. Shift Handover Report Generation

**When the user asks to generate a shift report:**

```bash
python scripts/alert_triager.py --report shift --shift night --date 2025-05-28 --output report.md

交接班报告模板：

# CSOC Shift Handover Report
**Shift:** Night (22:00–06:00 UTC)
**Date:** 2025-05-28
**Outgoing Analyst:** [Name]
**Incoming Analyst:** [Name]

---

## Shift Summary
| Metric | Count |
|--------|-------|
| Total Alerts | 142 |
| True Positives | 8 |
| False Positives | 118 |
| Undetermined | 16 |
| Incidents Declared | 2 |
| Average Triage Time | 12 minutes |
| SLA Compliance | 94.4% |

## Open Incidents (Require Immediate Attention)
| ID | Type | Severity | Status | Owner | Next Action |
|----|------|----------|--------|-------|-------------|
| INC-2025-089 | Phishing Campaign | P2 | Investigating | [Name] | Awaiting EDR report |
| INC-2025-090 | Suspicious Login | P3 | Monitoring | [Name] | 24h watch, escalate if repeat |

## Alerts Closed This Shift
- 118 False Positives auto-closed (brute force from known scanners, pen test activity)
- 12 True Positives resolved (malware blocked by AV, no further action needed)

## Ongoing Watches (No Action Yet Required)
- Increased scan activity from 198.51.100.0/24 — monitoring trend
- User [email protected] multiple failed VPN logins — watching for successful auth

## Tool/System Issues
- Splunk indexer latency 45 min this shift — events delayed, may affect investigation timing
- EDR console intermittently slow — reported to IT ops (ticket: OPS-4421)

## Recommended Actions for Next Shift
1. Follow up on INC-2025-089: EDR report expected from endpoint team by 08:00
2. Review [email protected] VPN activity — if successful login from new location, triage
3. Watch for continued scanning from 198.51.100.x block

5. SOC 指标与 KPI 跟踪

当用户询问 SOC 指标或 KPI 分析时：

SOC 关键指标：

指标	公式	目标
MTTD（平均检测时间）	Avg(detection_time − attack_start_time)	< 1 hour
MTTR（平均响应时间）	Avg(response_complete − detection_time)	< 4 hours
MTTC（平均遏制时间）	Avg(contain_time − detection_time)	< 1 hour
误报率	FP / (FP + TP) × 100	< 20%
警报与工单比率	Tickets / Total Alerts	< 5%（健康水平）
SLA 合规率	Alerts within SLA / Total Alerts	> 95%
分析师处理能力	每位分析师每班次处理的警报数	跟踪趋势
升级率	Escalated to Tier 2/3 / Total Tickets	< 20%

月度 KPI 仪表板模板：

## SOC Monthly Metrics Report — May 2025

### Volume
- Total Alerts: 4,215
- True Positives: 287 (6.8%)
- False Positives: 3,928 (93.2%)
- Incidents Declared: 14

### Response Performance
- MTTD: 23 minutes (↓ from 31 min last month) ✓
- MTTR: 3.2 hours (↑ from 2.8 hours) ⚠
- SLA Compliance: 96.1% ✓

### Top Alert Categories
1. Brute Force Attempts: 1,842 (94% FP from scanner IPs)
2. Malware Detected: 412 (78% TP)
3. Data Loss Prevention: 287 (32% TP)
4. Privilege Escalation: 156 (65% TP)

### Recommendations
1. Allowlist known scanner IPs to reduce brute force FP volume (-40% alert load)
2. MTTR increased due to EDR tool latency — investigate performance

---

脚本参考

alert_triager.py

python scripts/alert_triager.py --alerts alerts.json --output triage_results.json
python scripts/alert_triager.py --alerts siem_export.csv --playbook default --auto-assign

report_generator.py

python scripts/report_generator.py --shift night --date 2025-05-28 --output report.md
python scripts/report_generator.py --metrics monthly --date 2025-05 --output metrics.json

---

技能集成

条件	相邻技能
警报需要深入调查	→ 技能 07（事件响应）
深入分析日志以了解警报背景	→ 技能 12（日志分析）
根据警报模式开展威胁狩猎	→ 技能 06（威胁狩猎）
所有检测技能都会向此处发送警报	← 所有检测技能

---

参考资料

• NIST 网络安全框架
• SANS SOC 最佳实践
• Splunk SOAR Playbooks
• Palo Alto XSOAR 文档
• TheHive Project
• SOC 成熟度模型（SOC-CMM）

---

v3.0 增强功能（2026 年更新）

AI 增强、指标驱动的 SOC：

• AI 辅助分诊 — 使用大模型总结警报、对重复警报聚类、补充威胁情报，并起草分析师的初步处置意见；任何遏制操作执行前都必须经过人工审核（安全的 Agent 设计请参阅 Skill 16）。
• 检测即代码与 SOAR — 将剧本和检测规则纳入版本控制并进行测试；在人工查看工单前自动补充信息（WHOIS、VT、GeoIP、资产／身份上下文）。
• 警报调优循环 — 跟踪每条规则的误报率；当误报率超过阈值时，自动提出抑制或调优建议，以减少警报疲劳。
• MITRE D3FEND — 将每个剧本中的遏制／根除步骤映射到 D3FEND 对策，以补充 ATT&CK 覆盖范围。
• 指标 — 按 ATT&CK 策略报告 MTTD、MTTA、MTTR、驻留时间和检测覆盖率；追踪这些指标在各班次间的变化趋势。

精确性规则： 每项自动化操作都必须记录日志，并尽可能可逆，且须根据严重程度设置审核关卡；不可逆操作必须获得明确的人工批准。