triaging-security-incident-with-ir-playbook

使用 IR Playbook 对安全事件进行分流

使用场景

• 从 SIEM、EDR 或其他检测来源收到新的安全告警
• SOC 分析师需要确定告警是否为需要响应的真阳性
• 事件需要严重性分类和团队分配
• 多个并发事件需要确定优先级
• 自动化分流规则需要验证或调优

前提条件

• 具备告警关联能力的 SIEM 平台（Splunk、Elastic、QRadar、Sentinel）
• 事件响应 Playbook 库（按事件类型划分）
• 经 CISO 批准的严重性分类矩阵
• 值班轮换和升级流程
• 用于事件跟踪的工单系统（ServiceNow、Jira、TheHive）
• 用于 IOC 富化的威胁情报源

工作流

第 1 步：接收并确认告警

# Query Splunk for new critical/high severity alerts
index=notable status=new severity IN ("critical","high")
| table _time, rule_name, src, dest, severity, description
| sort -_time

# Query TheHive for new cases
curl -s -H "Authorization: Bearer $THEHIVE_API_KEY" \
  "https://thehive.local/api/v1/query?name=list-alerts" \
  -H "Content-Type: application/json" \
  -d '{"query":[{"_name":"listAlert"},{"_name":"filter","_field":"status","_value":"New"}]}'

# Acknowledge alert in SIEM to prevent duplicate triage
curl -X POST "https://splunk.local:8089/services/notable_update" \
  -H "Authorization: Bearer $SPLUNK_TOKEN" \
  -d "ruleUIDs=$RULE_UID&status=1&comment=Triage+initiated+by+analyst"

第 2 步：富化告警数据

# Enrich source IP with VirusTotal
curl -s "https://www.virustotal.com/api/v3/ip_addresses/$SRC_IP" \
  -H "x-apikey: $VT_API_KEY" | jq '.data.attributes.last_analysis_stats'

# Check IP reputation with AbuseIPDB
curl -s "https://api.abuseipdb.com/api/v2/check?ipAddress=$SRC_IP&maxAgeInDays=90" \
  -H "Key: $ABUSEIPDB_KEY" -H "Accept: application/json" | jq '.data'

# Enrich file hash with threat intelligence
curl -s "https://www.virustotal.com/api/v3/files/$FILE_HASH" \
  -H "x-apikey: $VT_API_KEY" | jq '.data.attributes.last_analysis_stats'

# Query internal asset database for affected systems
curl -s "https://cmdb.local/api/assets?ip=$DEST_IP" \
  -H "Authorization: Bearer $CMDB_TOKEN" | jq '.asset_criticality, .owner, .environment'

第 3 步：分类事件类型

# Map alert to incident category using playbook lookup
# Categories: Malware, Phishing, Unauthorized Access, Data Exfiltration,
# DoS/DDoS, Insider Threat, Ransomware, Account Compromise, Web Attack

# Check if alert matches known playbook trigger conditions
grep -i "$ALERT_SIGNATURE" /opt/ir/playbooks/trigger_conditions.yaml

# Determine incident type from MITRE ATT&CK technique
curl -s "https://attack.mitre.org/api/techniques/$TECHNIQUE_ID" | jq '.name, .tactic'

第 4 步：分配严重性级别

# Severity matrix factors:
# 1. Asset criticality (Critical/High/Medium/Low)
# 2. Data sensitivity (PII/PHI/PCI/Confidential/Public)
# 3. Number of affected systems
# 4. Active vs historical threat
# 5. Confirmed vs suspected compromise

# Automated severity calculation
python3 -c "
severity_score = 0
# Asset criticality: Critical=4, High=3, Medium=2, Low=1
severity_score += 4  # Critical server
# Data sensitivity: PII/PHI=4, PCI=3, Confidential=2, Public=1
severity_score += 3  # PCI data
# Scope: Enterprise=4, Department=3, Single system=2, Single user=1
severity_score += 2  # Single system
# Threat status: Active=4, Recent=3, Historical=2, Potential=1
severity_score += 4  # Active threat

if severity_score >= 12: print('CRITICAL - P1')
elif severity_score >= 9: print('HIGH - P2')
elif severity_score >= 6: print('MEDIUM - P3')
else: print('LOW - P4')
print(f'Score: {severity_score}/16')
"

第 5 步：选择并启动 Playbook

# Load appropriate playbook based on incident type
cat /opt/ir/playbooks/ransomware_playbook.yaml
cat /opt/ir/playbooks/phishing_playbook.yaml
cat /opt/ir/playbooks/unauthorized_access_playbook.yaml

# Create incident ticket in TheHive
curl -X POST "https://thehive.local/api/v1/case" \
  -H "Authorization: Bearer $THEHIVE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "IR-2024-XXX: [Incident Type] - [Brief Description]",
    "description": "Triage summary and initial findings",
    "severity": 3,
    "tlp": 2,
    "pap": 2,
    "tags": ["ransomware", "triage-complete"],
    "customFields": {
      "playbook": {"string": "ransomware_v2"},
      "affected_systems": {"integer": 5}
    }
  }'

第 6 步：分配响应团队

# Check on-call schedule
curl -s "https://pagerduty.com/api/v2/oncalls?schedule_ids[]=$SCHEDULE_ID" \
  -H "Authorization: Token token=$PD_TOKEN" | jq '.oncalls[].user.summary'

# Page incident responders based on severity
# P1/Critical: Page IR lead + senior analysts + CISO
# P2/High: Page IR lead + available analysts
# P3/Medium: Assign to next available analyst
# P4/Low: Queue for business hours processing

curl -X POST "https://events.pagerduty.com/v2/enqueue" \
  -H "Content-Type: application/json" \
  -d '{
    "routing_key": "'$PD_ROUTING_KEY'",
    "event_action": "trigger",
    "payload": {
      "summary": "P1 Security Incident: Ransomware detected on PROD-DB-01",
      "severity": "critical",
      "source": "SIEM-Splunk",
      "custom_details": {"incident_id": "IR-2024-042", "playbook": "ransomware_v2"}
    }
  }'

第 7 步：记录分流决策并移交

# Update incident ticket with triage summary
curl -X PATCH "https://thehive.local/api/v1/case/$CASE_ID" \
  -H "Authorization: Bearer $THEHIVE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "status": "InProgress",
    "customFields": {
      "triage_analyst": {"string": "analyst_name"},
      "triage_time": {"date": '$(date +%s000)'},
      "severity_justification": {"string": "Critical asset + active threat + PCI data"}
    }
  }'

关键概念

概念	描述
真阳性	告警正确识别出真实的安全事件
假阳性	告警错误地将正常活动标记为恶意
严重性分类	根据影响和紧迫性对事件优先级进行排序
Playbook 选择	根据事件类型选择适当的响应流程
IOC 富化	从威胁情报来源为指标添加上下文
升级阈值	触发升级到更高严重性或管理层的标准
分流 SLA	初始评估的时间目标（关键事件通常为 15-30 分钟）

工具与系统

工具	用途
Splunk/Elastic/QRadar	SIEM 告警关联与查询
TheHive/SIRP	事件案例管理与 Playbook 跟踪
VirusTotal/AbuseIPDB	IOC 信誉与富化
PagerDuty/OpsGenie	值班管理与告警
MITRE ATT&CK	技术分类与映射
Cortex XSOAR	用于自动化分流工作流的 SOAR 平台

常见场景

1. 暴力破解告警：来自单一 IP 的多次登录失败。富化 IP 信誉，检查地理位置，核实账户是否被入侵，若未成功则分配 P3。
2. 终端上检测到恶意软件：AV/EDR 已隔离恶意软件。核实隔离是否成功，检查是否存在横向移动，若检测到持久化则分配 P2。
3. 可疑出站流量：向未知外部 IP 的大规模数据传输。检查是否为已知云服务，核实数据分类，若确认数据外泄则分配 P1。
4. 上报钓鱼邮件：用户上报可疑邮件。提取 IOC，检查其他人是否收到，若已输入凭据则分配 P2。
5. 权限提升：用户意外获得管理员权限。核实是否为已授权变更，检查是否存在漏洞利用，若未经授权则分配 P1。

输出格式

• 带严重性论证的分流决策文档
• 包含已分配 Playbook 和团队的事件工单
• 附加到案例的 IOC 富化摘要
• 向相关利益方发送的升级通知
• 来自告警数据的事件初始时间线