amitambekar510/elk-ir-playbooks

## 📌 关于本项目 本仓库包含 **59 个可用于生产环境的 YAML 事件响应剧本**，专为 **ELK SIEM 技术栈 (Elasticsearch · Logstash · Kibana)** 设计。每个剧本均直接基于真实的 ELK 检测规则导出构建 —— 这意味着每个剧本都映射到已在 ELK 部署中触发的**真实检测规则**。 ### 为什么要有这个项目 大多数 IR 剧本都是与实际 SIEM 检测脱节的通用 Word 文档。本项目弥补了这一差距 —— 每个剧本都： - ✅ **关联到真实的 ELK 规则 ID**，提取自实时的 ELK 导出文件 - ✅ **即开即用的查询** —— 每个剧本都包含 KQL/EQL 检测查询 - ✅ **针对特定行业** —— 每个剧本都包含金融（经纪商级别）和医疗保健扩展 - ✅ **符合合规要求** —— FCA、SEC、FINRA、HIPAA、GDPR、PCI-DSS、NY DFS 500 - ✅ **映射 MITRE ATT&CK** —— 涵盖了从初始访问到影响的所有战术 - ✅ **适配 ELK Cases** —— 可直接作为 Kibana Security Cases 的响应工作流附加使用 ## 🗂️ 仓库结构 ``` elk-ir-playbooks/ │ ├── 📂 playbooks/ # 59 IR Playbooks (YAML) │ ├── endpoint/ # 16 playbooks — Windows, Linux, macOS, EDR │ ├── cloud/ # 8 playbooks — AWS, Azure, GCP, Kubernetes │ ├── identity/ # 8 playbooks — AD, Okta, Entra ID, BEC │ ├── network/ # 8 playbooks — Firewall, DDoS, C2, Recon │ ├── application/ # 7 playbooks — WebApp, GitHub, CI/CD │ ├── threat-intel/ # 5 playbooks — TI Match, UEBA, Hunting │ └── compliance/ # 7 playbooks — Breach, DLP, Physical │ ├── 📂 .github/ │ ├── ISSUE_TEMPLATE/ # Bug report & feature request templates │ ├── workflows/ # GitHub Actions CI/CD │ └── PULL_REQUEST_TEMPLATE.md # PR review checklist │ ├── 📂 scripts/ │ ├── validate_playbooks.py # 7-mode YAML validation │ ├── elk_import.py # ELK API import helper │ └── generate_index.py # Rebuild playbook index │ ├── 📂 tests/ │ └── test_playbook_schema.py # pytest schema compliance (9 tests) │ ├── 📂 docs/ │ ├── getting_started.md # Quick start guide │ ├── index_patterns.md # ELK index pattern reference │ ├── elk_integration.md # How to attach to ELK Cases │ ├── sector_extensions.md # Finance & Healthcare guide │ └── mitre_coverage.md # ATT&CK coverage map │ ├── 📂 assets/ # Logo and social preview images ├── 📂 wiki/ # Extended documentation ├── .github/CODEOWNERS # Review ownership ├── SECURITY.md # Vulnerability reporting ├── CONTRIBUTING.md # Contribution guidelines ├── CHANGELOG.md # Version history └── README.md # This file ``` ## 📊 覆盖范围概览 ``` ┌─────────────────────────────────────────────────────────────────────────────────┐ │ 59 PLAYBOOKS — 360° SIEM COVERAGE │ ├──────────────────────┬────────────┬──────────────────────────────────────────── │ │ Category │ Playbooks │ Key Scenarios │ ├──────────────────────┼────────────┼────────────────────────────────────────────┤ │ 🖥️ Endpoint │ 16 │ Malware · Ransomware · SSH · PowerShell │ │ ☁️ Cloud │ 8 │ AWS · Azure · GCP · Kubernetes │ │ 🔐 Identity │ 8 │ AD · Okta · Account Compromise · BEC │ │ 🌐 Network │ 8 │ DDoS · C2 · Firewall · Lateral Movement │ │ ⚙️ Application │ 7 │ Web App · WebShell · CI/CD · Supply Chain │ │ 🎯 Threat Intel │ 5 │ TI Match · UEBA · Correlation · Hunting │ │ 📋 Compliance │ 7 │ Data Breach · DLP · Physical · Extortion │ ├──────────────────────┼────────────┼────────────────────────────────────────────┤ │ TOTAL │ 59 │ 1,924 ELK rules · 95.7% coverage │ └──────────────────────┴────────────┴────────────────────────────────────────────┘ ``` ### MITRE ATT&CK 覆盖范围 ``` Initial Access ██████████████████████ PB-01,06,07,08,09,11,12,20,31,33,48,49,53,54 Execution ██████████████████████ PB-02,15,18,25,26,28,30,37,38,45,55 Persistence ██████████████████████ PB-02,07,19,22,28,35,36,42,45,46 Privilege Escalation ██████████████████████ PB-04,13,18,25,26,36,44,51 Defense Evasion ██████████████████████ PB-29,37,38,44,46,47,55 Credential Access ██████████████████████ PB-06,11,12,17,35,36,43,45 Discovery ██████████████████████ PB-04,13,16,17,18,39,51,52 Lateral Movement ██████████████████████ PB-02,07,18,25,36 Collection ██████████████████████ PB-05,14,40,52,54 Command & Control ██████████████████████ PB-02,15,27,39,45,50,55 Exfiltration ██████████████████████ PB-05,14,23,40,43,57 Impact ██████████████████████ PB-02,03,24,30,53,57 ``` ## 🚀 快速开始 ``` # 1 — 克隆仓库 git clone https://github.com/amitambekar510/elk-ir-playbooks.git cd elk-ir-playbooks # 2 — 安装依赖 pip install pyyaml pytest # 3 — 验证全部 59 个 playbook python3 scripts/validate_playbooks.py # 4 — 运行 schema 合规性测试 python3 -m pytest tests/ -v # 5 — 列出所有 playbook python3 scripts/elk_import.py --list # 6 — 通过 API 导入到 ELK python3 scripts/elk_import.py \ --host https://your-elk.com \ --api-key YOUR_ELK_API_KEY # 7 — 导入特定 playbook python3 scripts/elk_import.py \ --host https://your-elk.com \ --api-key YOUR_ELK_API_KEY \ --playbook PB-02 ``` ## 🔧 ELK 集成 ### 步骤 1 — 将规则导入 Kibana ``` Kibana → Stack Management → Rules → Import → select playbook YAML ``` ### 步骤 2 — 作为 Case 响应工作流附加 ``` Kibana → Security → Cases → Settings → Response Actions → Add Workflow ``` 当告警触发时，ELK 会自动创建一个 Case，并将该剧本作为响应清单。 ### 步骤 3 — Index Patterns **标准 ELK 配置 (Fortinet + Windows + Linux):** ``` index_patterns: - "logs-endpoint.events.*" # Elastic Defend EDR - "logs-system.security*" # Windows Security Events - "winlogbeat-*" # Windows Event Logs - "auditbeat-*" # Linux audit logs - "filebeat-*" # Fortinet + file-based logs - "packetbeat-*" # Network traffic ``` **扩展配置 (Cloud + Identity):** ``` - "logs-okta*" # Okta - "logs-azure.*" # Azure / Entra ID - "logs-aws.cloudtrail-*" # AWS CloudTrail - "logs-gcp.audit-*" # GCP Audit Logs - "logs-o365*" # Microsoft 365 - "logs-github*" # GitHub audit - "logs-crowdstrike*" # CrowdStrike Falcon - "logs-sentinel_one*" # SentinelOne - "logs-panw.panos*" # Palo Alto PAN-OS ``` ## 📚 剧本目录 ### 🖥️ 端点安全 — 16 个剧本 | ID | 剧本 | 规则 | 阶段 | |---|---|---|---| | [`PB-01`](playbooks/endpoint/PB-01_Phishing_Playbook.yaml) | 钓鱼攻击事件响应 | `25` | `4` | | [`PB-02`](playbooks/endpoint/PB-02_Malware_Ransomware_Playbook.yaml) | 恶意软件与勒索软件事件响应 | `30` | `4` | | [`PB-07`](playbooks/endpoint/PB-07_SSH_Login_Playbook.yaml) | SSH 登录活动监控与响应 | `25` | `3` | | [`PB-08`](playbooks/endpoint/PB-08_Windows_Login_Failure_Playbook.yaml) | Windows 登录失败与暴力破解响应 | `8` | `3` | | [`PB-11`](playbooks/endpoint/PB-11_Phishing_RuleDriven_Playbook.yaml) | 钓鱼 —— 基于检测规则的响应 | `16` | `3` | | [`PB-19`](playbooks/endpoint/PB-19_macOS_Endpoint_Playbook.yaml) | macOS 端点威胁响应 | `20` | `3` | | [`PB-26`](playbooks/endpoint/PB-26_Privilege_Escalation_Playbook.yaml) | 权限提升检测与响应 | `20` | `3` | | [`PB-28`](playbooks/endpoint/PB-28_Persistence_Mechanisms_Playbook.yaml) | 持久化机制检测与响应 | `20` | `3` | | [`PB-29`](playbooks/endpoint/PB-29_Defense_Evasion_Playbook.yaml) | 防御绕过检测与响应 | `20` | `3` | | [`PB-37`](playbooks/endpoint/PB-37_LOLBin_LivingOffTheLand_Playbook.yaml) | 无文件攻击响应 | `20` | `3` | | [`PB-38`](playbooks/endpoint/PB-38_PowerShell_Abuse_Playbook.yaml) | PowerShell 滥用与恶意脚本执行响应 | `20` | `3` | | [`PB-45`](playbooks/endpoint/PB-45_Reverse_Shell_Detection_Playbook.yaml) | 反向 Shell 检测与响应 | `20` | `3` | | [`PB-46`](playbooks/endpoint/PB-46_SentinelOne_CrowdStrike_EDR_Playbook.yaml) | SentinelOne 与 CrowdStrike EDR 告警响应 | `0` | `3` | | [`PB-47`](playbooks/endpoint/PB-47_Microsoft_Defender_XDR_Playbook.yaml) | Microsoft Defender XDR 告警响应 | `20` | `3` | | [`PB-51`](playbooks/endpoint/PB-51_Linux_Discovery_Enumeration_Playbook.yaml) | Linux 系统发现与枚举响应 | `7` | `3` | | [`PB-56`](playbooks/endpoint/PB-56_Smartphone_Mobile_Device_Compromise_Playbook.yaml) | 智能手机与移动设备入侵响应 | `0` | `3` | ### ☁️ 云安全 — 8 个剧本 | ID | 剧本 | 规则 | 阶段 | |---|---|---|---| | [`PB-16`](playbooks/cloud/PB-16_AWS_Cloud_Account_Compromise_Playbook.yaml) | AWS 云账户入侵与滥用响应 | `20` | `3` | | [`PB-17`](playbooks/cloud/PB-17_Azure_EntraID_Identity_Playbook.yaml) | Azure 与 Entra ID 身份攻击响应 | `20` | `3` | | [`PB-18`](playbooks/cloud/PB-18_Kubernetes_Container_Playbook.yaml) | Kubernetes 与容器安全事件响应 | `20` | `3` | | [`PB-21`](playbooks/cloud/PB-21_SaaS_Collaboration_Platform_Playbook.yaml) | SaaS 与协作平台攻击响应 (M365 / Google Workspace) | `20` | `3` | | [`PB-24`](playbooks/cloud/PB-24_AI_Cloud_Resource_Abuse_Playbook.yaml) | AI 与云资源滥用（可用性）响应 | `2` | `3` | | [`PB-30`](playbooks/cloud/PB-30_Cryptojacking_Playbook.yaml) | 挖矿劫持与未经授权的加密货币挖矿响应 | `3` | `3` | | [`PB-34`](playbooks/cloud/PB-34_GCP_Threats_Playbook.yaml) | Google Cloud Platform (GCP) 威胁响应 | `20` | `3` | | [`PB-41`](playbooks/cloud/PB-41_Cloud_Misconfiguration_Playbook.yaml) | 云错误配置检测与修复响应 | `11` | `3` | ### 🔐 身份与访问 — 8 个剧本 | ID | 剧本 | 规则 | 阶段 | |---|---|---|---| | [`PB-04`](playbooks/identity/PB-04_Insider_Threat_Playbook.yaml) | 内部威胁事件响应 | `25` | `3` | | [`PB-06`](playbooks/identity/PB-06_Account_Compromise_Playbook.yaml) | 账户入侵与身份攻击事件响应 | `25` | `3` | | [`PB-12`](playbooks/identity/PB-12_Social_Engineering_Playbook.yaml) | 社会工程学与冒充响应 | `20` | `3` | | [`PB-13`](playbooks/identity/PB-13_Insider_Threat_RuleDriven_Playbook.yaml) | 内部威胁 —— UEBA 与行为规则驱动的响应 | `25` | `2` | | [`PB-32`](playbooks/identity/PB-32_Email_Security_Threats_Playbook.yaml) | 电子邮件安全威胁响应 (Inbox Rules / Forwarding / BEC) | `5` | `3` | | [`PB-35`](playbooks/identity/PB-35_Okta_Identity_Threats_Playbook.yaml) | Okta 身份平台威胁响应 | `20` | `3` | | [`PB-36`](playbooks/identity/PB-36_Active_Directory_Attacks_Playbook.yaml) | Active Directory 攻击响应 (Kerberoasting / DCSync / Golden Ticket) | `20` | `3` | | [`PB-54`](playbooks/identity/PB-54_Business_Email_Compromise_BEC_Playbook.yaml) | 商业电子邮件入侵 (BEC) 与 CEO 诈骗响应 | `0` | `4` | ### 🌐 网络安全 — 8 个剧本 | ID | 剧本 | 规则 | 阶段 | |---|---|---|---| | [`PB-03`](playbooks/network/PB-03_DDoS_Playbook.yaml) | 分布式拒绝服务 (DDoS) 事件响应 | `20` | `3` | | [`PB-09`](playbooks/network/PB-09_Firewall_Login_Attempt_Playbook.yaml) | 防火墙 登录尝试监控 | `6` | `3` | | [`PB-25`](playbooks/network/PB-25_Lateral_Movement_Playbook.yaml) | 横向移动检测与响应 | `20` | `3` | | [`PB-27`](playbooks/network/PB-27_C2_Beaconing_Playbook.yaml) | 命令与控制 (C2) 信标检测与响应 | `20` | `3` | | [`PB-39`](playbooks/network/PB-39_Network_Reconnaissance_Playbook.yaml) | 网络侦察与发现响应 | `20` | `3` | | [`PB-49`](playbooks/network/PB-49_PanOS_Palo_Alto_Firewall_Playbook.yaml) | Palo Alto Networks (PAN-OS) 防火墙威胁响应 | `20` | `3` | | [`PB-50`](playbooks/network/PB-50_Anomalous_Traffic_Rare_Destinations_Playbook.yaml) | 异常流量与罕见目标告警响应 | `15` | `3` | | [`PB-55`](playbooks/network/PB-55_Botnet_Infrastructure_Abuse_Playbook.yaml) | 僵尸网络感染与基础设施滥用响应 | `0` | `3` | ### ⚙️ 应用安全 — 7 个剧本 | ID | 剧本 | 规则 | 阶段 | |---|---|---|---| | [`PB-20`](playbooks/application/PB-20_Vulnerability_CVE_Playbook.yaml) | 漏洞与主动利用 (CVE) 响应 | `20` | `3` | | [`PB-22`](playbooks/application/PB-22_GitHub_SourceCode_Playbook.yaml) | GitHub 与源代码安全事件响应 | `20` | `3` | | [`PB-31`](playbooks/application/PB-31_Web_Application_Attack_Playbook.yaml) | Web 应用攻击响应 (SQLi / XSS / RCE / WebShell) | `20` | `3` | | [`PB-33`](playbooks/application/PB-33_Supply_Chain_ThirdParty_Playbook.yaml) | 供应链与第三方入侵响应 | `20` | `3` | | [`PB-42`](playbooks/application/PB-42_CICD_Pipeline_Security_Playbook.yaml) | CI/CD 流水线安全事件响应 | `20` | `3` | | [`PB-48`](playbooks/application/PB-48_Web_Server_Threats_Playbook.yaml) | Web 服务器威胁响应 (Apache / Nginx / IIS / Tomcat) | `20` | `3` | | [`PB-53`](playbooks/application/PB-53_Web_Defacement_Playbook.yaml) | 网页篡改事件响应 | `0` | `4` | ### 🎯 威胁情报 — 5 个剧本 | ID | 剧本 | 规则 | 阶段 | |---|---|---|---| | [`PB-14`](playbooks/threat-intel/PB-14_UEBA_Alert_Playbook.yaml) | UEBA (用户与实体行为分析) 告警响应 | `25` | `3` | | [`PB-15`](playbooks/threat-intel/PB-15_AI_Based_Alerts_Playbook.yaml) | 基于 AI 的告警响应 (LLM 分诊、ESQL 关联与 GenAI 安全) | `0` | `3` | | [`PB-43`](playbooks/threat-intel/PB-43_Threat_Intelligence_Indicator_Match_Playbook.yaml) | 威胁情报指标匹配响应 | `8` | `3` | | [`PB-44`](playbooks/threat-intel/PB-44_Multi_Alert_Correlation_Playbook.yaml) | 多告警关联响应 (主机与用户攻击链) | `9` | `3` | | [`PB-52`](playbooks/threat-intel/PB-52_Threat_Hunting_Resource_Development_Playbook.yaml) | 威胁狩猎与攻击者资源开发响应 | `8` | `3` | ### 📋 合规与数据 — 7 个剧本 | ID | 剧本 | 规则 | 阶段 | |---|---|---|---| | [`PB-05`](playbooks/compliance/PB-05_Data_Breach_Playbook.yaml) | 数据泄露事件响应 | `20` | `3` | | [`PB-10`](playbooks/compliance/PB-10_Policy_Violation_Playbook.yaml) | 策略违规检测与响应 | `11` | `3` | | [`PB-23`](playbooks/compliance/PB-23_DLP_Alert_Playbook.yaml) | 数据防泄漏 (DLP) 告警响应 | `3` | `3` | | [`PB-40`](playbooks/compliance/PB-40_Data_Staging_Collection_Playbook.yaml) | 数据收集与处理（外发前）响应 | `20` | `3` | | [`PB-57`](playbooks/compliance/PB-57_Blackmail_Extortion_Ransom_Demand_Playbook.yaml) | 敲诈勒索、敲诈与网络勒索要求响应 | `0` | `3` | | [`PB-58`](playbooks/compliance/PB-58_Physical_Security_Incident_Playbook.yaml) | 物理安全事件响应 (设备被盗 / 非法侵入 / 恶意介质) | `0` | `3` | | [`PB-59`](playbooks/compliance/PB-59_Vulnerability_Disclosure_Playbook.yaml) | 漏洞披露与负责任的披露响应 | `0` | `3` | ## 🏢 行业扩展 每个剧本都包含**两个强制性的行业特定部分**，涵盖监管要求、上报路径以及特定领域的响应步骤。

💰 金融（经纪商级别）扩展

每个金融扩展涵盖： | 领域 | 详情 | |---|---| | **监管机构** | FCA (英国)、SEC (美国)、FINRA、NY DFS 500、PCI-DSS | | **交易系统** | OMS、EMS、行情数据源、清算 (DTC/LCH/SWIFT) | | **电汇** | 撤销程序、OFAC 制裁检查、FinCEN SAR | | **客户义务** | GLBA 保障规则、身份保护 | | **终端撤销** | Bloomberg、Refinitiv Eikon、DTC/DTCC 访问检查清单 | | **关键时间线** | FCA: 72小时 · SEC Form 8-K: 4天 · GLBA: 30天 · PCI: 立即 |

>

🏥 医疗保健行业扩展

每个医疗保健扩展涵盖： | 领域 | 详情 | |---|---| | **HIPAA** | 4 项要素泄露风险评估、HHS OCR 报告 | | **EHR 系统** | Epic、Cerner、Meditech 审计程序 | | **临床停机** | 触发条件、基于纸质文档的回退程序 | | **患者安全** | 对每起网络安全事件进行临床影响审查 | | **DEA** | 管制物质系统入侵报告 | | **关键时间线** | HHS OCR: 60天 (500人以上) · GDPR: 72小时 · 州总检察长: 不一 | ## 📁 剧本 YAML Schema 每个剧本均遵循以下结构： ``` playbook: id: PB-XX # PB-01 through PB-59 title: "" # Descriptive title version: "1.0.0" # Semantic version last_updated: "YYYY-MM-DD" classification: "CONFIDENTIAL" owner: "Security Operations Centre (SOC)" elk_integration: import_path: "Stack Management > Rules > Import" workflow_path: "Security > Cases > Create Case" index_patterns: [] # ← Fill in for your environment mitre_coverage: tactics: [] # ATT&CK tactics techniques: [] # ATT&CK techniques devices_in_scope: [] severity_matrix: # P1 Critical → P4 Low - level: "P1_Critical" condition: "" sla_minutes: 15 escalation: "" elk_detection_rules: [] # Real rule IDs from ELK exports elk_detection_queries: [] # KQL/EQL queries response_phases: # Step-by-step IR phases - phase: 1 name: "" steps: - step: 1 action: "" owner: "" elk_query: "" sector_extensions: finance_broker_level: [] # Finance regulatory steps healthcare_broker_level: [] # Healthcare regulatory steps ``` ## 🧪 验证与测试 ``` # 验证全部 59 个 playbook（7 种模式） python3 scripts/validate_playbooks.py # 单独模式验证 python3 scripts/validate_playbooks.py --mode syntax python3 scripts/validate_playbooks.py --mode schema python3 scripts/validate_playbooks.py --mode fields python3 scripts/validate_playbooks.py --mode secrets python3 scripts/validate_playbooks.py --mode classification # 运行全部 9 个 pytest 测试 python3 -m pytest tests/test_playbook_schema.py -v # 预期输出： # PASSED tests/test_playbook_schema.py::test_playbook_count # PASSED tests/test_playbook_schema.py::test_all_valid_yaml # PASSED tests/test_playbook_schema.py::test_required_fields # PASSED tests/test_playbook_schema.py::test_sector_extensions # PASSED tests/test_playbook_schema.py::test_response_phases # PASSED tests/test_playbook_schema.py::test_severity_matrix # PASSED tests/test_playbook_schema.py::test_playbook_ids # PASSED tests/test_playbook_schema.py::test_no_secrets # PASSED tests/test_playbook_schema.py::test_elk_integration # 9 passed ``` ## 📜 参考资料与标准 | 标准 | 覆盖范围 | |---|---| | [MITRE ATT&CK](https://attack.mitre.org) | 每个剧本中包含完整的战术/技术映射 | | [NIST CSF](https://www.nist.gov/cyberframework) | 识别 → 保护 → 检测 → 响应 → 恢复 | | [ISO 27035](https://www.iso.org/standard/62071.html) | IR 流程生命周期对齐 | | [CERT SG IRM](https://github.com/certsocietegenerale/IRM) | IRM-07 至 IRM-18 (PB-53 至 PB-59) | | [meirwah/awesome-incident-response](https://github.com/meirwah/awesome-incident-response) | 差距分析参考 | | [Elastic Security](https://www.elastic.co/security) | ELK SIEM 平台 | ## 👤 作者 ## 📄 许可证 ``` MIT License Copyright (c) 2025 Amit Ambekar (amitambekar510) Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files, to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND. ```

标签：ELK, 内容过滤, 安全剧本, 安全规则引擎, 安全运营, 库, 应急响应, 扫描框架, 逆向工具