security-recommended-actions

安全事件建议操作

概述

此技能通过分析威胁类型、严重程度、受影响资产和组织预案，为安全事件生成结构化、按优先级排序的响应操作。它会生成分阶段的操作计划，涵盖遏制、根除和恢复，并遵循 NIST SP 800-61 和组织 SOC 流程。

主要功能：

• 针对特定威胁的操作： 根据具体威胁类别（恶意软件、网络钓鱼、数据外泄、DDoS、内部威胁等）生成相应操作
• 基于严重程度的优先级排序： 根据事件严重程度和业务关键性调整响应的紧迫程度和深度
• 考虑资产的建议： 根据受影响资产的类型、环境和关键性调整操作
• 与预案保持一致： 将建议的操作映射到现有组织预案和运行手册
• 分阶段响应计划： 将操作分为遏制、根除、恢复和事件后阶段
• MITRE ATT&CK 映射： 引用特定的 ATT&CK 技术以指导检测和响应

使用场景：

• 新建安全事件后，分析师需要响应指导
• 事件升级期间，确保涵盖所有关键操作
• 初级分析师需要关于响应流程的结构化指导
• 关闭事件前，检查事件响应是否完整
• 为重复发生的威胁类型生成标准化响应计划

先决条件

• 角色： sn_si.analyst、sn_si.manager 或 admin
• 插件： Security Incident Response（sn_si）、Threat Intelligence（sn_ti）、Vulnerability Response（sn_vul）
• 访问权限： 对 sn_si_incident、sn_si_task、sn_ti_observable、cmdb_ci、sn_vul_vulnerable_item 的读取权限
• 知识： 熟悉 NIST SP 800-61、MITRE ATT&CK 框架和组织预案结构

关键表

表	用途	关键字段
sn_si_incident	安全事件	number、category、subcategory、priority、severity、state、cmdb_ci、attack_vector、kill_chain_phase、business_criticality
sn_si_task	响应任务	number、short_description、state、task_type、security_incident、assigned_to、priority
sn_ti_observable	威胁指标	type、value、confidence、threat_score、security_incident
cmdb_ci	受影响资产	name、sys_class_name、ip_address、os、environment、business_criticality
sn_vul_vulnerable_item	已知漏洞	vulnerability、cmdb_ci、state、cvss_score、risk_score

流程

步骤 1：获取事件详情和分类

获取包含威胁分类字段的完整事件记录。

使用 MCP（Claude Code/Desktop）：

Tool: SN-Get-Record
Parameters:
  table_name: sn_si_incident
  sys_id: [INCIDENT_SYS_ID]
  fields: sys_id,number,short_description,description,category,subcategory,priority,severity,state,cmdb_ci,attack_vector,kill_chain_phase,business_criticality,risk_score,assigned_to,assignment_group,opened_at,contact_type,affected_user

使用 REST API：

GET /api/now/table/sn_si_incident?sysparm_query=number=[SIR_NUMBER]&sysparm_fields=sys_id,number,short_description,description,category,subcategory,priority,severity,state,cmdb_ci,attack_vector,kill_chain_phase,business_criticality,risk_score,assigned_to,assignment_group,opened_at&sysparm_limit=1&sysparm_display_value=all

步骤 2：收集受影响资产的上下文

获取配置项详情，以了解受影响系统的业务背景。

使用 MCP：

Tool: SN-Query-Table
Parameters:
  table_name: cmdb_ci
  query: sys_id=[CMDB_CI_SYS_ID]
  fields: sys_id,name,sys_class_name,ip_address,os,environment,business_criticality,support_group,department,location,operational_status
  limit: 1

使用 REST API：

GET /api/now/table/cmdb_ci?sysparm_query=sys_id=[CI_SYS_ID]&sysparm_fields=sys_id,name,sys_class_name,ip_address,os,environment,business_criticality,support_group,department,location,operational_status&sysparm_limit=1&sysparm_display_value=true

步骤 3：收集威胁指标

提取 IOC，为针对特定威胁的遏制和根除操作提供依据。

使用 MCP：

Tool: SN-Query-Table
Parameters:
  table_name: sn_ti_observable
  query: security_incident=[INCIDENT_SYS_ID]
  fields: sys_id,type,value,source,confidence,threat_score,first_seen,last_seen
  limit: 100

使用 REST API：

GET /api/now/table/sn_ti_observable?sysparm_query=security_incident=[INCIDENT_SYS_ID]&sysparm_fields=sys_id,type,value,source,confidence,threat_score&sysparm_limit=100

步骤 4：检查受影响资产上的已知漏洞

识别可能使攻击得以发生的可利用漏洞。

使用 MCP：

Tool: SN-Query-Table
Parameters:
  table_name: sn_vul_vulnerable_item
  query: cmdb_ci=[AFFECTED_CI_SYS_ID]^stateINOpen,Under Investigation
  fields: sys_id,vulnerability,cmdb_ci,state,cvss_score,risk_score,first_found
  limit: 20

使用 REST API：

GET /api/now/table/sn_vul_vulnerable_item?sysparm_query=cmdb_ci=[CI_SYS_ID]^stateINOpen,Under Investigation&sysparm_fields=sys_id,vulnerability,cmdb_ci,state,cvss_score,risk_score,first_found&sysparm_limit=20&sysparm_display_value=true

步骤 5：检查现有响应任务

查看现有任务，避免重复操作。

使用 MCP：

Tool: SN-Query-Table
Parameters:
  table_name: sn_si_task
  query: security_incident=[INCIDENT_SYS_ID]^ORDERBYopened_at
  fields: sys_id,number,short_description,state,task_type,assigned_to,priority
  limit: 50

步骤 6：生成建议操作

生成分阶段、针对特定威胁的响应操作。

使用 MCP：

Tool: SN-Execute-Background-Script
Parameters:
  script: |
    var sirNumber = 'SIR0009100'; // Replace with target incident
    var gr = new GlideRecord('sn_si_incident');
    gr.addQuery('number', sirNumber);
    gr.query();

    if (!gr.next()) { gs.info('Incident not found'); return; }

    var category = gr.category.getDisplayValue().toLowerCase();
    var severity = gr.severity.getDisplayValue();
    var priority = parseInt(gr.priority.toString()) || 3;
    var ciSysId = gr.cmdb_ci.toString();
    var actions = { containment: [], eradication: [], recovery: [], post_incident: [] };

    // Get CI details
    var ciType = 'unknown';
    var ciEnv = 'unknown';
    if (ciSysId) {
      var ci = new GlideRecord('cmdb_ci');
      if (ci.get(ciSysId)) {
        ciType = ci.sys_class_name.toString();
        ciEnv = ci.environment.getDisplayValue() || 'unknown';
      }
    }

    // Collect IOCs
    var iocCount = 0;
    var iocTypes = {};
    var obs = new GlideRecord('sn_ti_observable');
    obs.addQuery('security_incident', gr.sys_id.toString());
    obs.query();
    while (obs.next()) {
      iocCount++;
      var t = obs.type.getDisplayValue() || 'other';
      iocTypes[t] = (iocTypes[t] || 0) + 1;
    }

    // === CONTAINMENT ACTIONS ===
    // Universal containment
    actions.containment.push({
      action: 'Document initial findings and preserve volatile evidence',
      priority: 1, owner: 'SOC Analyst', timeline: 'Immediate',
      details: 'Capture memory dump, running processes, network connections before any changes'
    });

    if (category.indexOf('malware') >= 0 || category.indexOf('ransomware') >= 0) {
      actions.containment.push({
        action: 'Isolate affected host(s) from network',
        priority: 1, owner: 'Network Operations', timeline: '< 30 minutes',
        details: 'Apply network isolation via EDR or switch port disable. Do NOT power off to preserve memory.'
      });
      actions.containment.push({
        action: 'Block identified C2 IPs and domains at perimeter',
        priority: 1, owner: 'SOC Analyst', timeline: '< 1 hour',
        details: 'Update firewall rules and DNS sinkhole for ' + iocCount + ' identified IOCs'
      });
      actions.eradication.push({
        action: 'Remove malware artifacts and persistence mechanisms',
        priority: 1, owner: 'DFIR Team', timeline: '< 24 hours',
        details: 'Scan with updated signatures, check scheduled tasks, registry run keys, WMI subscriptions'
      });
      actions.recovery.push({
        action: 'Rebuild or restore affected systems from known-good baseline',
        priority: 2, owner: 'IT Operations', timeline: '24-48 hours',
        details: 'Reimage ' + (ciType.indexOf('server') >= 0 ? 'server' : 'workstation') + ' from golden image or verified backup'
      });
    }

    if (category.indexOf('phishing') >= 0) {
      actions.containment.push({
        action: 'Quarantine phishing email from all mailboxes',
        priority: 1, owner: 'Email Security', timeline: '< 1 hour',
        details: 'Use email security tool to search and purge by sender, subject, or message ID'
      });
      actions.containment.push({
        action: 'Reset credentials for affected user(s)',
        priority: 1, owner: 'IAM Team', timeline: '< 2 hours',
        details: 'Force password reset and revoke active sessions for compromised accounts'
      });
      actions.eradication.push({
        action: 'Block sender domain and update email filtering rules',
        priority: 2, owner: 'Email Security', timeline: '< 4 hours',
        details: 'Add sender to blocklist and create content filtering rule for similar messages'
      });
    }

    if (category.indexOf('data') >= 0 || category.indexOf('exfiltration') >= 0 || category.indexOf('breach') >= 0) {
      actions.containment.push({
        action: 'Identify and block data exfiltration channels',
        priority: 1, owner: 'SOC Analyst', timeline: '< 1 hour',
        details: 'Review DLP alerts, proxy logs, and cloud storage activity for ongoing exfiltration'
      });
      actions.containment.push({
        action: 'Revoke access for compromised accounts and API keys',
        priority: 1, owner: 'IAM Team', timeline: '< 2 hours',
        details: 'Disable affected service accounts, rotate API keys, revoke OAuth tokens'
      });
      actions.recovery.push({
        action: 'Assess data exposure scope and prepare regulatory notification',
        priority: 1, owner: 'Legal/Privacy Team', timeline: '< 72 hours',
        details: 'Determine data types affected, number of records, and applicable notification requirements'
      });
    }

    // Universal eradication
    actions.eradication.push({
      action: 'Patch exploited vulnerabilities on affected and similar systems',
      priority: 2, owner: 'Vulnerability Management', timeline: '< 72 hours',
      details: 'Apply patches for identified CVEs; scan environment for same vulnerability'
    });

    // Universal recovery
    actions.recovery.push({
      action: 'Validate system integrity and restore to operational status',
      priority: 2, owner: 'IT Operations', timeline: '48-72 hours',
      details: 'Verify clean state, run integrity checks, restore network connectivity with monitoring'
    });
    actions.recovery.push({
      action: 'Enhance monitoring on recovered systems for 30 days',
      priority: 3, owner: 'SOC Analyst', timeline: 'Ongoing',
      details: 'Increase logging verbosity, add detection rules for related IOCs and TTPs'
    });

    // Post-incident
    actions.post_incident.push({
      action: 'Conduct post-incident review and document lessons learned',
      priority: 3, owner: 'SOC Manager', timeline: '< 2 weeks post-resolution',
      details: 'Review detection time, response effectiveness, and identify process improvements'
    });
    actions.post_incident.push({
      action: 'Update playbooks and detection rules based on findings',
      priority: 3, owner: 'Detection Engineering', timeline: '< 30 days post-resolution',
      details: 'Create or update detection signatures, SIEM correlation rules, and response procedures'
    });

    var result = {
      incident: sirNumber,
      category: category,
      severity: severity,
      total_actions: actions.containment.length + actions.eradication.length + actions.recovery.length + actions.post_incident.length,
      phases: actions
    };

    gs.info('RECOMMENDED ACTIONS:\n' + JSON.stringify(result, null, 2));
  description: "SecOps: Generate phased response actions for a security incident"

步骤 7：将操作作为工作备注发布

使用 MCP：

Tool: SN-Add-Work-Notes
Parameters:
  table_name: sn_si_incident
  sys_id: [INCIDENT_SYS_ID]
  work_notes: |
    === RECOMMENDED RESPONSE ACTIONS ===
    Generated: 2026-03-19 | Category: Ransomware | Severity: Critical

    PHASE 1 - CONTAINMENT (Immediate):
    [ ] Document findings and preserve volatile evidence (SOC Analyst, Immediate)
    [ ] Isolate affected hosts from network (Network Ops, < 30 min)
    [ ] Block C2 IPs/domains at perimeter (SOC Analyst, < 1 hour)

    PHASE 2 - ERADICATION (24-72 hours):
    [ ] Remove malware and persistence mechanisms (DFIR Team, < 24 hours)
    [ ] Patch exploited vulnerabilities (Vuln Mgmt, < 72 hours)

    PHASE 3 - RECOVERY (48-72 hours):
    [ ] Rebuild affected systems from known-good baseline (IT Ops, 24-48 hours)
    [ ] Validate system integrity (IT Ops, 48-72 hours)
    [ ] Enhance monitoring for 30 days (SOC Analyst, Ongoing)

    PHASE 4 - POST-INCIDENT (2-4 weeks):
    [ ] Conduct lessons learned review (SOC Manager, < 2 weeks)
    [ ] Update playbooks and detection rules (Detection Engineering, < 30 days)

工具使用

操作	MCP 工具	REST 端点
读取事件	SN-Get-Record	GET /api/now/table/sn_si_incident/{sys_id}
查询资产	SN-Query-Table	GET /api/now/table/cmdb_ci
查询 IOC	SN-Query-Table	GET /api/now/table/sn_ti_observable
查询漏洞	SN-Query-Table	GET /api/now/table/sn_vul_vulnerable_item
生成操作	SN-Execute-Background-Script	POST /api/now/table/sys_trigger
发布操作	SN-Add-Work-Notes	PATCH /api/now/table/sn_si_incident/{sys_id}

最佳实践

• 按阶段组织： 始终按照 NIST SP 800-61，将操作划分为遏制、根除、恢复和事后阶段
• 针对威胁定制： 根据具体威胁类型定制操作；通用操作会浪费分析人员的时间
• 优先保全证据： 在建议可能改变系统状态的遏制操作之前，始终建议先保全证据
• 明确负责人： 将每项操作分配给具体团队或角色，而不仅仅是“团队”
• 合理安排时间： 设定时间安排时，应考虑生产环境中的变更管理要求
• 去重： 生成建议前检查现有任务，避免重复
• 升级触发条件： 包含升级标准（例如检测到横向移动、确认数据外泄）

故障排除

无法识别事件类别

症状： 由于类别与预期值不匹配，生成的操作过于笼统 原因： 组织可能使用自定义类别和子类别值 解决方案： 查询 sys_choice 中的 sn_si_incident.category，以获取有效值。将自定义类别映射到标准威胁类型（恶意软件、网络钓鱼、数据泄露等）。

事件未关联 IOC

症状： 没有 IOC 时，无法生成针对特定威胁的遏制操作 原因： 威胁情报可能尚未集成，或可观测项尚未关联 解决方案： 建议将收集 IOC 作为首要遏制操作。按日期范围搜索 sn_ti_observable，查找近期摄取的指标。

找不到该类别的行动手册

症状： 无法根据组织的行动手册制定操作 原因： sn_si_playbook 表中可能没有适用于该事件类别的行动手册 解决方案： 根据内置威胁分类体系生成操作，并建议将创建行动手册作为事后操作。

示例

示例 1：勒索软件事件响应计划

场景： SIR0009100 —— 财务文件服务器检测到 LockBit 勒索软件

1. 获取事件：类别“勒索软件”，严重程度“严重”，生产服务器
2. 收集资产背景信息：FILESVR-03、Windows Server 2022、业务关键性高
3. 收集 6 个 IOC：2 个 IP、1 个域名、2 个文件哈希、1 个电子邮件地址
4. 确认受影响服务器上存在 2 个可利用的 CVE
5. 生成涵盖 4 个阶段的 12 项操作，并明确时间安排和负责人
6. 将清单格式的操作发布到事件工作备注中

示例 2：网络钓鱼活动响应

场景： SIR0008890 —— 针对 50 名用户的凭据窃取网络钓鱼攻击

1. 获取事件：类别“网络钓鱼”，严重程度“高”，影响 50 名用户
2. 没有具体 CI——受影响实体为用户邮箱
3. IOC：1 个发件人域名、1 个网络钓鱼 URL、1 个表单提交端点
4. 生成 9 项操作：清除电子邮件、重置凭据、屏蔽 URL、通知用户
5. 加入事后建议：开展网络钓鱼安全意识培训

相关技能

• secops/incident-summarization - 总结事件并提供建议操作
• secops/post-incident-analysis - 评估建议的操作是否得到妥善执行
• secops/vulnerability-deduplication - 在确定操作优先级之前合并重复漏洞
• secops/correlation-insights - 找出可能共享响应操作的相关事件
• secops/shift-handover - 在交接班报告中纳入待处理操作