1
# 日志源配置
2
log_sources:
3
  # 网络设备
4
  firewalls:
5
    - vendor: sangfor
6
      protocol: syslog/UDP
7
      port: 514
8
      format: CEF
9

10
  # 主机日志
11
  endpoints:
12
    - type: osquery
13
      schedule: 300s
14
      query: SELECT * FROM process_events
15

16
  # 云日志
17
  cloud:
18
    - provider: aliyun
19
      service: ActionTrail
20
      format: JSON

1
# Sigma 规则示例
2
name: 暴力破解检测
3
logsource:
4
  product: windows
5
  service: security
6
  definition: 4625 登录失败事件
7

8
detection:
9
  selection:
10
    EventID: 4625
11
    LogonType: 3
12
  timeframe: 5m
13
  condition: |
14
    count() by IpAddress > 10
15

16
actions:
17
  - log
18
  - alert

1
# 关联规则
2
correlation_rules:
3
  - name: 横向移动检测
4
    queries:
5
      - query: |
6
          event_name: process_create
7
          parent_name: wmiprc.exe
8
      - query: |
9
          event_name: network_connect
10
          destination_port: 445
11
    interval: 10m
12
    with_keys:
13
      - hostname
14
    condition: join_by_hostname
15

16
  - name: 持久化检测
17
    queries:
18
      - reg_key_enable
19
      - scheduled_task_create
20
    condition: same_host_same_user
21
    severity: HIGH

1
# SOAR 剧本
2
playbooks:
3
  - name: 暴力破解响应
4
    trigger:
5
      rule: brute_force_alert
6
      severity: HIGH
7

8
    steps:
9
      - action: threat_intel_lookup
10
        input: source_ip
11

12
      - condition: intel.is_malicious
13
        true_path:
14
          - block_ip_firewall
15
          - isolate_endpoint
16
          - create_ticket
17

18
        false_path:
19
          - enrich_ip
20
          - send_notification

1
# 响应动作库
2
actions_library = {
3
    "block_ip": {
4
        "type": "network",
5
        "target": ["firewall", "waf"],
6
        "parameters": ["ip", "duration"],
7
        "verification": "session_query"
8
    },
9
    "isolate_endpoint": {
10
        "type": "edr",
11
        "target": ["sangfor_edr", "tanium"],
12
        "parameters": ["hostname", "isolation_type"]
13
    },
14
    "reset_password": {
15
        "type": "iam",
16
        "target": ["ldap", "ad"]
17
    }
18
}

1
sangfor_sip:
2
  # 采集能力
3
  collectors:
4
    - type: agent
5
      endpoint: EDR Agent
6
    - type: network
7
      devices: NGFW/AC
8
    - type: cloud
9
      services:
10
        - VMWare
11
        - K8s Audit
12
        - Aliyun ActionTrail
13

14
  # AI 检测
15
  ai_models:
16
    - anomaly_detection
17
    - behavior_baseline
18
    - threat_intel
19

20
  # 联动响应
21
  integrations:
22
    - block_ip: NGFW
23
    - isolate: EDR
24
    - ticket: ITSM

1
qianxin_ngsoc:
2
  features:
3
    - 时间线分析
4
    - 攻击链映射
5
    - 威胁情报
6
    - 自动化响应
7

8
  # 核心能力
9
  core:
10
    - 关联分析
11
    - UEBA
12
    - SOAR

1
dashboard_widgets:
2
  - type: security_score
3
    metrics:
4
      - endpoint_security
5
      - network_security
6
      - vulnerability_index
7
      - compliance_rate
8

9
  - type: attack_timeline
10
    events:
11
      - source: siem
12
      - source: edr
13
      - source: ngsoc

1
class SecurityScoreModel:
2
    def calculate(self, assets: List[Asset]) -> float:
3
        weights = {
4
            'vulnerability': 0.3,
5
            'threat': 0.25,
6
            'compliance': 0.25,
7
            'exposure': 0.2
8
        }
9

10
        score = 0
11
        for asset in assets:
12
            score += (
13
                asset.vulnerability * weights['vulnerability'] +
14
                asset.threat * weights['threat'] +
15
                # ...
16
            )
17
        return min(100, score)

1
xdr_correlation:
2
  # 网络行为
3
  network_events:
4
    - DNS 查询
5
    - TLS 指纹
6
    - HTTP 行为序列
7

8
  # 端点行为
9
  endpoint_events:
10
    - 进程链
11
    - 注册表修改
12
    - WMI 执行
13

14
  # 关联分析
15
  rules:
16
    - name: 无文件攻击检测
17
      query: |
18
        dns_query + process_create + registry_modify
19
      model: supervised