mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
96 lines
2.0 KiB
Markdown
96 lines
2.0 KiB
Markdown
# Workflows - SOAR Playbook with XSOAR
|
|
|
|
## Playbook Development Lifecycle
|
|
|
|
```
|
|
1. Identify Manual Process
|
|
- Document current analyst workflow
|
|
- Measure time per step
|
|
|
|
|
v
|
|
2. Design Playbook Logic
|
|
- Map decision points
|
|
- Identify automation candidates
|
|
- Define manual review gates
|
|
|
|
|
v
|
|
3. Build in XSOAR
|
|
- Create playbook in visual editor
|
|
- Configure integration commands
|
|
- Add conditional branches
|
|
- Write custom scripts if needed
|
|
|
|
|
v
|
|
4. Test with Sample Data
|
|
- Create test incidents
|
|
- Verify each task executes correctly
|
|
- Test error handling paths
|
|
|
|
|
v
|
|
5. Pilot in Production
|
|
- Run on subset of incidents
|
|
- Compare automated vs manual results
|
|
- Gather analyst feedback
|
|
|
|
|
v
|
|
6. Full Deployment
|
|
- Enable for all matching incidents
|
|
- Monitor playbook performance
|
|
- Track MTTR improvements
|
|
|
|
|
v
|
|
7. Continuous Improvement
|
|
- Review failed tasks monthly
|
|
- Update integrations as needed
|
|
- Add new sub-playbooks
|
|
```
|
|
|
|
## Incident Lifecycle in XSOAR
|
|
|
|
```
|
|
Alert Ingestion (SIEM/EDR/Email)
|
|
|
|
|
v
|
|
Pre-Processing (Classification, Deduplication)
|
|
|
|
|
v
|
|
Incident Created (Type, Severity, Owner assigned)
|
|
|
|
|
v
|
|
Playbook Triggered Automatically
|
|
|
|
|
+-- Enrichment Phase (parallel)
|
|
| |-- IP/Domain/Hash lookup
|
|
| |-- User/Asset lookup
|
|
| |-- TI feed correlation
|
|
|
|
|
+-- Analysis Phase
|
|
| |-- Verdict determination
|
|
| |-- Risk scoring
|
|
|
|
|
+-- Response Phase
|
|
| |-- Containment actions (auto or manual approval)
|
|
| |-- Eradication steps
|
|
| |-- Recovery procedures
|
|
|
|
|
+-- Documentation Phase
|
|
| |-- War room timeline
|
|
| |-- Closing report
|
|
| |-- Ticket update
|
|
|
|
|
v
|
|
Incident Closed
|
|
```
|
|
|
|
## ROI Measurement Workflow
|
|
|
|
```
|
|
Before SOAR:
|
|
Count manual hours per incident type per month
|
|
|
|
After SOAR:
|
|
Measure automated handling time
|
|
Calculate: Saved Hours = Manual Hours - Automated Hours
|
|
Calculate: ROI = (Saved Hours * Analyst Hourly Cost) / SOAR License Cost
|
|
```
|