CTA — Beispiel-Playbooks je Welle (VPE-Ansicht)

Ein Referenz-Playbook pro Welle im Stil des Splunk-SOAR Visual Playbook Editors. Jeder Block trägt einen Kommentar (Konvention), destruktive Actions liegen hinter Decision/Approval, und jede Welle addiert einen neuen Kniff. Actions verweisen auf die Fake-Apps aus dem Katalog.

Start Action (Enrich) Decision Format Custom Function Filter Prompt (Human) Response Utility Referee submit
WELLE 1 · TIER 1

Boot Camp — ioc_ip_triage

pb_ioc_ip_triage · active
Fokus: Mechanik. Linearer Flow — Artefakt lesen → formatieren → melden. Einführung der Kommentar-Konvention.
start
on_start
// trigger: container label = cta
format
build_flag
// defang IP → 'IP:{0}' src: artifact:*.cef.destinationAddress
action · submitCTA-Referee
submit result
// result = build_flag.formatted_data
action · noteSplunk ES
add finding note
// audit-trail zurück ins SIEM
WELLE 2 · TIER 2

Recon — rep_ip_verdict

pb_rep_ip_verdict · active
Kniff: Nested Decision — erst Custom-List prüfen, dann Reputation als Fallback.
start
on_start
utility · list
get list · cta_threat_ips
// kuratierte Blocklist laden
decision D1
IP in threat list?
// sourceAddress ∈ cta_threat_ips
YES
format
verdict = BLOCK
// 'BLOCK|{defang(ip)}'
NO · Fallback
actionCTA-GreyNoise
ip reputation
// zweite Meinung
decision D2
classification == malicious?
// summary.verdict
YES
format
BLOCK
NO
format
ALLOW
▼ alle Pfade → submit
submitCTA-Referee
submit result
WELLE 3 · TIER 3

Intrusion — auth_bruteforce

pb_auth_bruteforce · active
Kniff: SIEM-Pivot — der Container hat nur Teil-Events; die volle Wahrheit holt das Playbook per SPL aus dem SIEM.
start
on_start
action · SIEM pivotCTA-Splunk
run query
// alle auth-events des Users holen search index=auth user={sourceUserName} earliest=-1h | table _time,outcome
custom function
count_failures_in_window
// wiederverwendbar n = |failures in [max_ts-60s, max_ts]|
decision
n >= 5 ?
// threshold brute force
YES
format
BRUTEFORCE:{n}
NO
format
NORMAL
▼ join → submit (+ ES note)
submitCTA-Referee
submit result
WELLE 4 · TIER 4

Payload — malware_sandbox

pb_malware_sandbox · active
Kniffe: Edge-Case-Guard · parallele Enrichment + Join · 3-Wege-Decision · Multi-EDR-Routing der Response.
start
on_start
decision · guard
fileHashSha256 vorhanden?
// poison-data guard
NO
format
ERROR
YES
actionCTA-Sandbox
detonate file
// summary.score
actionCTA-VirusTotal
file reputation
// summary.score
▼ join beide Scores
custom function
s = max(sandbox, vt)
decision · 3-Wege
s ≥80 / 40–79 / <40
// MALICIOUS / SUSPICIOUS / CLEAN
Response nur bei MALICIOUS ↓
action · routingCTA-CrowdStrike
get device detail
// welcher EDR „besitzt" den Host?
decision · EDR-Router
EDR-Vendor?
CBC
responseCTA-CarbonBlack
ban hash
Defender
responseCTA-Defender
isolate device
▼ alle Pfade → submit (+ ES note)
submitCTA-Referee
submit result
WELLE 5 · TIER 5

Adversary — identity_impossible_travel

pb_impossible_travel · active  ·  sub: pb_calc_travel_speed
Kniffe: Sub-Playbook · Privileg-Eskalation · Human-in-the-Loop (Approval) · Retry/Backoff.
start
on_start
actionCTA-GeoIP
geolocate ip · login[0]
actionCTA-GeoIP
geolocate ip · login[1]
Retry/Backoff: bei status≠success → delay → retry (max 3)
▼ beide Koordinaten
sub-playbook
calc_travel_speed
// haversine(a,b) / Δt(h) = kmh
decision D1
kmh > 900 ?
NO
format
PLAUSIBLE:{kmh}
YES · impossible
actionCTA-Identity/Okta
get user groups
// Privileg prüfen
decision D2
User in 'Admins'?
// → severity high/medium
prompt · humanCTA-Slack
ask: disable {user}?
// approval-gate vor Response
decision D3
Antwort == yes ?
YES
responseOkta
disable user + clear sessions
NO
utility
note: monitored
format IMPOSSIBLE:{kmh}
▼ alle Pfade → submit (+ ES note)
submitCTA-Referee
submit result
WELLE 6/7 · TIER 6/7

DEFCON 1 — chaos_router (unerreichbar by design)

pb_chaos_router · active  ·  ruft pb_* Sub-Playbooks
Kniffe: Decoy-Suppress · defensive Null-Checks · Dynamic Dispatch (Router→Sub-Playbooks) · Multi-Container-State.
start
on_start
decision · decoy
Decoy-Marker vorhanden?
// change_ticket / expected_benign versteckt
YES · Decoy
format
BENIGN_DECOY
// NICHT actionen!
NO · echt
custom function
safe_parse / null-checks
// poison-data abfangen (leerer hash, neg. bytes, fehlende ts)
utility · state
get list · prior_context
// cross-container state (chain_dependent)
decision · ROUTER
dispatch by alert type
// dynamic dispatch
bruteforce
sub-playbook
pb_auth_bruteforce
malware
sub-playbook
pb_malware_sandbox
travel
sub-playbook
pb_impossible_travel
…
sub-playbook
pb_… (n)
▼ set list · prior_context (State aktualisieren)
▼ alle Pfade → submit (+ ES note)
submitCTA-Referee
submit result