Integration & Orchestration

<!-- ossec.conf integration block -->
<integration>
  <name>shuffle</name>
  <hook_url>https://shuffle.cyberbluesoc.local/api/v1/hooks/wazuh_webhook_id</hook_url>
  <level>8</level>
  <alert_format>json</alert_format>
</integration>

{
  "name": "Shuffle Notification",
  "endpoint": "https://shuffle.cyberbluesoc.local/api/v1/hooks/thehive_webhook_id",
  "events": ["case_created", "case_updated", "alert_created"],
  "format": "json"
}

[Wazuh Webhook: Alert Level >= 8]
       ↓
[Parse Alert] — Extract: source IP, dest IP, hostname, user, rule ID
       ↓
[Deduplication Check] — Has this IOC been enriched in the last hour?
      ↙          ↘
  Cached           Fresh
    ↓               ↓
  Use cache     [Enrichment Sub-Playbook]
    ↓            → VirusTotal lookup
    ↓            → MISP search
    ↓            → AbuseIPDB check (if IP)
    ↓               ↓
    ↓           [Cache Results]
    ↓               ↓
    └───────────────┘
           ↓
[Severity Scoring]
  Score = base_rule_level + intel_match_bonus + vt_detection_bonus
  HIGH: score >= 15  |  MEDIUM: score >= 10  |  LOW: score < 10
           ↓
[TheHive: Create Case]
  Title, description, severity, tags, observables — all auto-populated
           ↓
[Notification Router]
  HIGH → Slack #soc-critical + PagerDuty + email to L2
  MEDIUM → Slack #soc-alerts + email to L1 queue
  LOW → Slack #soc-low-priority (no page)

[Input: IOC type + value]
       ↓
[Router: What type?]
  ├── IP Address:
  │   → VirusTotal IP report
  │   → AbuseIPDB check
  │   → MISP search
  │   → MaxMind GeoIP lookup
  │   → Shodan host info
  │
  ├── Domain:
  │   → VirusTotal domain report
  │   → MISP search
  │   → WHOIS lookup
  │   → DNS resolution history
  │
  ├── Hash (MD5/SHA256):
  │   → VirusTotal file report
  │   → MISP search
  │   → MalwareBazaar lookup
  │
  └── URL:
      → VirusTotal URL scan
      → MISP search
      → URLhaus check
       ↓
[Aggregate Results]
  Combine all source results into a single enrichment object
  Calculate composite confidence score
       ↓
[Return Enrichment Object]

[TheHive: Case status changed to "Containment"]
       ↓
[Read Case Observables] — Get IOCs marked for blocking
       ↓
[For Each Observable marked "ioc"]:
  ├── IP Address → [Firewall: Add to block list]
  │   → Verify block applied
  │   → Log action to TheHive case
  │
  ├── Domain → [DNS Sinkhole: Add to blacklist]
  │   → Verify sinkhole active
  │   → Log action to TheHive case
  │
  ├── Account → [Active Directory: Disable account]
  │   → Force password reset
  │   → Revoke active sessions
  │   → Log action to TheHive case
  │
  └── Hostname → [Velociraptor: Network Isolation]
      → Collect volatile evidence first
      → Apply network isolation
      → Verify isolation (no outbound connections)
      → Log action to TheHive case
       ↓
[Post-Containment Verification]
  → Verify all blocks applied
  → Verify endpoint isolation
  → Update TheHive case with containment evidence
       ↓
[Notify IR Team]
  → "Containment complete. X IPs blocked, Y accounts disabled,
     Z endpoints isolated. Evidence collection in progress."

Step 1: Collect volatile artifacts
  → Windows.System.Pslist (running processes)
  → Windows.Network.Netstat (active connections)
  → Windows.System.DNSCache (recent DNS queries)

Step 2: Collect persistence artifacts
  → Windows.Sys.StartupItems
  → Windows.System.TaskScheduler

Step 3: Upload suspicious files
  → Upload malware binary for analysis

Step 4: Apply network isolation
  → Block all inbound/outbound except Velociraptor

Step 5: Verify isolation
  → Confirm no outbound connections remain

[SEVERITY] — [CATEGORY] — [HOSTNAME]

Alert: [Rule description]
Source: Wazuh Rule [ID], Level [X]
Host: [hostname] ([IP])
User: [username]
Time: [timestamp UTC]

Intel: [MISP match / No match] | VT: [X/Y detections]
Verdict: [MALICIOUS / SUSPICIOUS / UNKNOWN]
TheHive Case: [#case_id] — [link]

Action Required: [Specific next step for analyst]

[Incident declared CRITICAL]
       ↓
[Parallel notifications]:
  → Slack #incident-war-room: Full technical context
  → PagerDuty: Page on-call L2 and IR lead
  → Email to CISO: Executive summary
  → TheHive: Update case status to "Active Incident"
  → Slack #soc-general: "Major incident in progress — war room active"

Month 1: Deploy enrichment + notification workflows
  → Measure: enrichment time, notification delivery, false positive rate
  → Tune: Adjust severity scoring, fix API errors, update templates

Month 2: Add automated case creation
  → Measure: case creation time, field accuracy, analyst satisfaction
  → Tune: Improve field mapping, add missing observables

Month 3: Add automated containment (with approval gates)
  → Measure: time-to-contain, approval turnaround, containment accuracy
  → Tune: Refine approval thresholds, add edge case handling

Month 6: Review all workflows
  → Compare metrics to pre-automation baseline
  → Identify new automation candidates from analyst feedback
  → Retire or refactor underperforming playbooks

                    ┌─────────────────┐
                    │   Alert Sources  │
                    │  Wazuh · Suricata│
                    └────────┬────────┘
                             ↓
                    ┌─────────────────┐
                    │     Shuffle      │
                    │  (Orchestrator)  │
                    └────────┬────────┘
                             ↓
              ┌──────────────┼──────────────┐
              ↓              ↓              ↓
     ┌────────────┐  ┌────────────┐  ┌────────────┐
     │  Enrichment │  │    Case    │  │  Notification│
     │  Pipeline   │  │  Creation  │  │   Router    │
     │ VT·MISP·AIPDB│ │  TheHive   │  │ Slack·Email │
     └──────┬─────┘  └──────┬─────┘  └──────┬─────┘
            ↓               ↓               ↓
     ┌────────────┐  ┌────────────┐  ┌────────────┐
     │  Verdict    │  │ Containment│  │  Metrics    │
     │  Logic      │  │ Velociraptor│ │  Dashboard  │
     └─────────────┘  └─────────────┘ └─────────────┘