claitonr/blue-team-playbook

# 🛡️ 蓝队 Playbook [](./KQL-Queries/) [](./Playbooks/) [](./Scripts/) [](./Frameworks/) [](./Labs/) ## 📋 关于 专为 **SOC 分析师 (L1/L2)** 打造的完整仓库，重点关注： - 🔍 **检测** — 适用于 Microsoft Sentinel 的现成 KQL 查询 - 🛡️ **响应** — 事件响应 Playbooks (NIST 800-61) - 🤖 **自动化** — 用于安全运营的 Python 脚本 - 📚 **框架** — MITRE ATT&CK、Cyber Kill Chain、NIST - 🎯 **认证** — SC-200 + ISC2 CC 备考资料 - 💼 **职业** — SOC L1 面试准备指南 ## 🗂 结构 ``` blue-team-playbook/ │ ├── SOC-Foundations/ # Fundamentos de SOC │ ├── hierarchy-and-roles # Hierarquia L1/L2/L3 │ ├── incident-response # Ciclo NIST 800-61 │ ├── triage # FP vs TP, priorização │ └── mitre-mapping # Mapeamento de alertas │ ├── KQL-Queries/ # Consultas para Microsoft Sentinel │ ├── brute-force # Detecção de força bruta │ ├── phishing # Análise de phishing │ ├── malware # Propagação de malware │ ├── ransomware # Detecção de ransomware │ ├── lateral-movement # Movimentação lateral │ └── account-compromise # Conta comprometida │ ├── Playbooks/ # Resposta a incidentes │ ├── ransomware-response # Resposta a ransomware │ ├── phishing-triage # Triagem de phishing │ ├── malware-outbreak # Surto de malware │ ├── account-compromise # Conta comprometida │ └── ddos-mitigation # Mitigação DDoS │ ├── Microsoft-Security/ # Ecossistema Microsoft │ ├── defender-xdr # Microsoft 365 Defender │ ├── sentinel-config # Configuração Sentinel │ ├── analytics-rules # Regras de análise │ └── incident-mgmt # Gerenciamento incidentes │ ├── Scripts/ # Automação Python │ ├── hash-lookup # Consulta VirusTotal │ ├── log-parser # Parse de logs │ ├── ip-reputation # Reputação de IP │ └── report-generator # Gerador de relatórios │ ├── Labs/ # Laboratórios práticos │ ├── sentinel-kql-basics # KQL básico no Sentinel │ ├── defender-endpoint # Defender para Endpoint │ ├── sc-200-notes # Resumo SC-200 │ └── threat-hunting # Caça a ameaças │ ├── Interview-Prep/ # Preparação para entrevistas │ ├── technical # Perguntas técnicas │ ├── scenarios # Cenários práticos │ └── behavioral # Perguntas comportamentais │ ├── Frameworks/ # Frameworks de segurança │ ├── nist-800-61 # Guia NIST │ ├── mitre-attack # MITRE ATT&CK Navigator │ └── cyber-kill-chain # Cyber Kill Chain │ └── README.md # ← Você está aqui ``` ## 🛠 技术与工具 | 类别 | 工具 | |-----------|------------| | **SIEM** | Microsoft Sentinel、Splunk、Elastic Security | | **EDR/XDR** | Microsoft Defender XDR、CrowdStrike、SentinelOne | | **SOAR** | Microsoft Sentinel Playbooks (Logic Apps) | | **Query** | KQL (Kusto Query Language)、SPL (Splunk) | | **Framework** | MITRE ATT&CK、NIST 800-61、Cyber Kill Chain | | **自动化** | Python、PowerShell、KQL | | **Cloud** | Azure、Microsoft 365、Defender for Cloud | ## 🚀 如何使用 ``` # Clone 仓库 git clone https://github.com/seu-usuario/blue-team-playbook.git # 探索 KQL 查询 cd KQL-Queries/ cat brute-force-detection.kql # 阅读 playbooks cd ../Playbooks/ cat ransomware-response.md # 执行脚本（需要 Python 3） cd ../Scripts/ pip install -r requirements.txt python vt-hash-lookup.py ``` ## 📌 路线图 - [x] 仓库基础结构 - [x] KQL 查询（暴力破解、网络钓鱼、恶意软件） - [x] 事件响应 Playbooks - [x] 自动化 Python 脚本 - [ ] Microsoft Sentinel 实践实验室 - [ ] 集成 MITRE ATT&CK Navigator - [ ] 示例仪表板 (JSON) - [ ] SC-200 完整指南 - [ ] Anki 抽认卡（可导入） ## 🏆 相关认证 | 认证 | 提供商 | 状态 | |-------------|----------|--------| | Google Cybersecurity | Google | ✅ 已完成 | | SC-200: Security Operations Analyst | Microsoft | 🔄 学习中 | | Certified in Cybersecurity (CC) | ISC2 | 📅 已安排 | ## 📖 资源 - [Microsoft Learn — SC-200](https://learn.microsoft.com/pt-br/credentials/certifications/security-operations-analyst/) - [MITRE ATT&CK](https://attack.mitre.org/) - [NIST 800-61](https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final) - [Microsoft 365 Defender](https://learn.microsoft.com/en-us/microsoft-365/security/defender/) ## 📄 许可证 本项目基于 MIT 许可证。查看 [LICENSE](LICENSE) 文件了解更多详情。 **由 🛡️ [你的名字] 倾力打造** *蓝队 | SOC 分析师 | Microsoft 安全*

标签：AI合规, KQL, Microsoft Sentinel, 库, 应急响应, 逆向工具