drdre4664/threat-intelligence-automation-platform

# 企业 SOC 自动化平台 (ESAP) 一个全自动化的安全运营中心 (SOC) 平台，能够处理多向量安全告警，将其映射到 MITRE ATT&CK，通过 SOAR 自动化进行情报富化，执行主动威胁狩猎，并生成可直接提交给管理层的报告。该平台旨在模拟企业级规模下的 Tier 2 SOC 分析师工作流程。 ## 项目功能 该平台接收跨 5 种攻击向量的 15 个安全告警，并通过 3 阶段的 pipeline 进行处理： 1. **被动检测** — 根据严重程度对每个告警进行分类，映射到 MITRE ATT&CK，使用 SOAR 上下文进行情报富化，并生成事件工单 2. **主动威胁狩猎** — 运行 5 个假设驱动的狩猎任务，以发现单个告警容易遗漏的威胁 3. **执行摘要** — 生成一份面向管理层的报告，包含严重程度统计、攻击向量分解、MITRE 覆盖范围和首要建议 ## 项目结构 ``` enterprise-soc-platform/ ├── data/ │ └── alerts.json # 15 simulated alerts across 5 vectors ├── src/ │ ├── detection_engine.py # Severity classification + contextual upgrades │ ├── mitre_mapper.py # MITRE ATT&CK tactic and technique mapping │ ├── soar_orchestrator.py # IP enrichment, account risk, response playbooks │ └── threat_hunter.py # 5 proactive threat hunt hypotheses ├── reports/ │ └── tickets/ # Auto-generated incident tickets └── run.py # Main entry point ``` ## 覆盖的攻击向量 | 向量 | 告警类型 | |--------|-------------| | Email | 钓鱼邮件、钓鱼活动、凭据收集 | | Endpoint | 暴力破解、权限提升、横向移动、数据外发 | | Cloud (AWS) | Root 登录、IAM 变更、安全组变更、凭据泄露 | | DLP | 敏感数据邮件、敏感数据上传 | | Web | SQL 注入、SSRF | ## MITRE ATT&CK 覆盖范围 | 战术 | 技术 | ID | |--------|-----------|-----| | Initial Access | Phishing | T1566 | | Initial Access | Valid Accounts | T1078 | | Initial Access | Exploit Public-Facing Application | T1190 | | Credential Access | Brute Force | T1110 | | Credential Access | Input Capture | T1056 | | Credential Access | Unsecured Credentials | T1552 | | Privilege Escalation | Abuse Elevation Control Mechanism | T1548 | | Lateral Movement | Remote Services | T1021 | | Persistence | Account Manipulation | T1098 | | Defense Evasion | Impair Defenses | T1562 | | Collection | Data from Information Repositories | T1213 | | Exfiltration | Exfiltration Over Alternative Protocol | T1048 | | Exfiltration | Exfiltration Over Web Service | T1567 | | Discovery | Cloud Infrastructure Discovery | T1580 | ## 威胁狩猎假设 | 狩猎 ID | 名称 | 查找目标 | |---------|------|-------------------| | H-001 | 未检测到的横向移动 | 在多个主机上出现的内部 IP | | H-002 | 非工作时间的特权访问 | 在晚上 11 点至凌晨 5 点之间活跃的特权账户 | | H-003 | 跨多个向量的相同 IP | 单个攻击者 IP 同时发起 email + web + cloud 攻击 | | H-004 | Root 登录后的云环境持久化 | 在 Root 登录后 1 小时内的 IAM/安全组变更 | | H-005 | 钓鱼基础设施扩展 | 超出已检测活动范围的仿冒域名 | ## 事件工单示例 ``` ================================================================= INCIDENT TICKET — ALT-005 ================================================================= Timestamp : 2026-07-10T03:17:44Z Alert Type : Lateral Movement Severity : CRITICAL Host : dbserver01 Source IP : 10.0.1.45 [Internal] Username : admin Description : Admin account moving laterally from webserver01 to dbserver01 MITRE ATT&CK Tactic : Lateral Movement (TA0008) Technique : Remote Services (T1021) ENRICHMENT IP Risk : Medium — internal host may be compromised Account : CRITICAL — privileged account involved RESPONSE PLAYBOOK 1. IMMEDIATE: Isolate all affected hosts from network 2. Disable compromised account across all systems 3. Block source IP at internal firewall 4. Preserve forensic evidence on each host 5. Notify SOC lead — full incident response activation ================================================================= ``` ## 运行方式 ``` python3 -m venv venv source venv/bin/activate pip install -r requirements.txt # no external dependencies — stdlib only python run.py ``` ## 平台输出 ``` [+] Loaded 15 alerts PHASE 1 — REACTIVE DETECTION & RESPONSE ALT-001 — Phishing Campaign 🔴 CRITICAL ALT-002 — Brute Force 🔴 CRITICAL ALT-003 — Lateral Movement 🔴 CRITICAL ... PHASE 2 — PROACTIVE THREAT HUNTING ⚠️ H-001 — Lateral movement detected across 3 hosts ⚠️ H-004 — IAM change within 1 hour of root login ✅ H-002 — No off-hours privileged access found PHASE 3 — EXECUTIVE SUMMARY Total Alerts : 15 🔴 Critical : 11 🟠 High : 4 Top Recommendations: ... ``` ## 展示的技能 - **SOC 运营**：多向量告警甄别、严重程度分类、事件工单管理 - **MITRE ATT&CK**：涵盖 14 项技术的完整战术与技术映射 - **SOAR**：自动化情报富化、IP 分类 (RFC 1918)、账户风险评分、响应 playbook - **威胁狩猎**：涵盖 5 种场景的假设驱动主动狩猎 - **Python**：模块化架构、JSON 处理、Counter、defaultdict、文件 I/O - **高管报告**：严重程度细分、向量分析、可操作建议 ## 相关项目 [企业级攻击检测实验室](https://github.com/Idris_Junaid/enterprise-attack-detection-lab) — 一个实时攻击模拟实验室，在 Flask 服务器上发起真实的暴力破解和 SQL 注入攻击，并进行实时检测。

标签：CISA项目, Cloudflare, Homebrew安装, MITRE ATT&CK, PE 加载器, SOAR, Web报告查看器, 安全运营, 扫描框架, 自动化响应, 逆向工具