hzmndt/secops-threat-hunting-automation

# Google SecOps Threat Intelligence & Threat Hunting 自动化 一套自动化、端到端的 Python 工具链，用于从 **Google Security Operations (Google SecOps)** 提取新兴威胁情报（包含 IOC 匹配的 Threat Collections），审计威胁覆盖情况，在目标 SOAR 环境中执行自动化的 `:runThreatHunt` API 任务，并验证已创建的 Cases 和 Investigations。 ## 🎯 架构与工作流 ``` flowchart TD A[Google SecOps Threat Intelligence API] -->|Fetch Campaigns with IOC Matches| B(fetch_emerging_threats.py) B -->|Save threat_collections_matches.json| C(audit_campaign_hunts.py) C -->|Audit Tenant Cases & Map Campaign IDs| D{Campaign Hunt Status} D -->|Ran Before| E[Skip Execution / Log Status] D -->|Not Yet Ran| F(run_campaign_threat_hunts.py) F -->|POST :runThreatHunt API| G[Google SecOps Backend Engine] G -->|Rate Limit 429 Retry & 5m Spacing| H[SOAR Environment / Case Creation] H -->|Validate Cases & Investigations| I(verify_secops_cases.py) ``` ## 📋 前置条件与 IAM 设置 1. **Google Cloud 配置与环境变量：** 使用环境变量配置您的实例参数，或者直接在脚本中更新 headers： export SECOPS_CUSTOMER_ID="" export GCP_PROJECT_ID="" export GCP_REGION="" # 例如 us, europe-west3, asia-southeast1 export SECOPS_SERVICE_ACCOUNT="" export SECOPS_ENVIRONMENT_ID="" export SECOPS_SOAR_USER_ID="" 2. **所需 IAM 权限：** - `chronicle.instances.runThreatHunt`（允许触发 threat hunt 任务） - `chronicle.instances.get` / `chronicle.cases.list`（允许查询租户 cases 及环境） 3. **OAuth2 授权范围：** - `https://www.googleapis.com/auth/cloud-platform` - `https://www.googleapis.com/auth/chronicle` ## 🚀 快速入门指南 ### 1. 安装 克隆此代码库并安装依赖项： ``` git clone https://github.com//secops-threat-hunting-automation.git cd secops-threat-hunting-automation pip install requests ``` ### 2. 逐步执行 #### 步骤 1：拉取包含 IOC 匹配的新兴 Threat Collections 从 Emerging Threat Center 中提取在您的环境中具有 IOC 匹配的活跃威胁活动和报告： ``` python3 fetch_emerging_threats.py ``` *输出：*生成 `threat_collections_matches.json`。 #### 步骤 2：审计活动覆盖情况与现有 Cases 将威胁活动与您在 Google SecOps 中的现有 cases 进行交叉比对，以识别尚未提交的活动 threat hunts： ``` python3 audit_campaign_hunts.py ``` *输出：*生成 `campaign_hunts_audit.json`。 #### 步骤 3：执行带有速率限制处理的自动化 Threat Hunts 为未提交的活动提交 `:runThreatHunt` REST API 请求。自动通过指数退避重试和 5 分钟的活动间隔来处理 `429 RESOURCE_EXHAUSTED` 响应： ``` python3 run_campaign_threat_hunts.py ``` *输出：*生成 `threat_hunt_submissions.json`。 #### 步骤 4：验证创建的 SOAR Cases 和 Investigations 查询目标 SOAR 环境以检查创建的 threat hunt cases： ``` python3 verify_secops_cases.py ``` ## 🛠 REST API 参考：`:runThreatHunt` ``` POST https://{REGION}-chronicle.googleapis.com/v1alpha/projects/{PROJECT_ID}/locations/{REGION}/instances/{CUSTOMER_ID}:runThreatHunt ``` ### 请求 Payload Schema ``` { "interval": { "startTime": "2026-06-23T01:58:11.436Z", "endTime": "2026-07-21T01:58:11.436Z" }, "campaign": "CAMP.26.094", "environment": "projects/{PROJECT_ID}/locations/{REGION}/instances/{CUSTOMER_ID}/environments/{ENVIRONMENT_ID}", "legacySoarUser": "projects/{PROJECT_ID}/locations/{REGION}/instances/{CUSTOMER_ID}/legacySoarUsers/{SOAR_USER_ID}" } ``` ## 📁 代码库结构 ``` . ├── README.md # Documentation & Architecture Blueprint ├── fetch_emerging_threats.py # Extracts Threat Collections with IOC matches ├── audit_campaign_hunts.py # Audits campaign hunt coverage against cases ├── run_campaign_threat_hunts.py # Submits :runThreatHunt requests with 429 backoff └── verify_secops_cases.py # Queries & verifies created SOAR cases ``` ## 📄 许可证 内部安全运营工具 — Google SecOps 集成。

标签：API集成, PB级数据处理, Python, SOAR, 可观测性, 威胁情报, 安全运维, 开发者工具, 无后门, 逆向工具