# ── STEP 1  Create the outer (decoy) volume ───────────────────────────────────
veracrypt --text --create /media/usb/research.vc \
  --volume-type=normal --size=3G \
  --encryption=AES --hash=SHA-512 --filesystem=FAT \
  --password='ResearchDocs2024!' \
  --pim=0 --keyfiles='' --random-source=/dev/urandom

# ── STEP 2  Mount outer volume and populate with plausible decoy files ────────
veracrypt --text --mount /media/usb/research.vc /mnt/outer \
  --password='ResearchDocs2024!' --protect-hidden=no
cp -r ~/Documents/PublicResearch/* /mnt/outer/
veracrypt --text --dismount /mnt/outer

# ── STEP 3  Create hidden volume inside the outer container ───────────────────
veracrypt --text --create /media/usb/research.vc \
  --volume-type=hidden --size=800M \
  --encryption=AES-Twofish-Serpent --hash=Whirlpool \
  --filesystem=EXT4 \
  --password='Src!2024$XkP9mN' --pim=485 \
  --keyfiles='/home/user/auth.jpg' \
  --random-source=/dev/urandom

# ── STEP 4  Mount hidden volume (normal operation) ────────────────────────────
veracrypt --text --mount /media/usb/research.vc /mnt/hidden \
  --password='Src!2024$XkP9mN' --pim=485 \
  --keyfiles='/home/user/auth.jpg' --protect-hidden=no

# ── STEP 5  Border crossing scenario — provide ONLY outer password ────────────
veracrypt --text --mount /media/usb/research.vc /mnt/shown \
  --password='ResearchDocs2024!' --protect-hidden=no
ls /mnt/shown/
# Reveals ONLY: PublicResearch/  ClimateData/  OpenSourceNotes/
# Hidden volume: statistically indistinguishable from random free space

# ── AxCrypt CLI (axcrypt.exe) — batch file encryption ────────────────────────
# Encrypt a single file
axcrypt.exe --encrypt --passphrase 'FirmPass2024!Secure' \
  --in 'C:\ClientFiles\Contracts\ClientABC_NDA.docx'
# Creates: ClientABC_NDA.axx

# Encrypt with Key Sharing for two attorneys and one paralegal
axcrypt.exe --encrypt --passphrase 'FirmPass2024!Secure' \
  --share attorney1@lawfirm.com \
  --share attorney2@lawfirm.com \
  --share paralegal@lawfirm.com \
  --in 'C:\ClientFiles\Matters\M-2024-0847\Settlement.pdf'

# Batch encrypt all Word and PDF files in a matter folder
for /r 'C:\ClientFiles\Matters\M-2024-0847' %f in (*.docx *.pdf *.xlsx) do ^
  axcrypt.exe --encrypt --passphrase 'FirmPass2024!Secure' --in "%f"

# Confirm all plaintext files are now replaced by .axx encrypted files
dir /s /b C:\ClientFiles\Matters\M-2024-0847\*.docx 2>nul
# Expected: 0 results — all .docx converted to .axx
dir /s /b C:\ClientFiles\Matters\M-2024-0847\*.axx | find /c ".axx"

# Decrypt a file to a temp working area
axcrypt.exe --decrypt --passphrase 'FirmPass2024!Secure' \
  --in 'C:\ClientFiles\Matters\M-2024-0847\Settlement.axx' \
  --out 'C:\Temp\Working\Settlement.pdf'

# Secured Folder configuration (AxCrypt GUI)
# AxCrypt > Secured Folders > Add: C:\ClientFiles\
# Any file placed here is auto-encrypted to .axx on save

# ── BitLocker PowerShell management ──────────────────────────────────────────
# Enable BitLocker XTS-AES-256 with TPM + 6-digit PIN on C:
Enable-BitLocker -MountPoint 'C:' \
  -EncryptionMethod XtsAes256 \
  -TpmAndPinProtector \
  -Pin (ConvertTo-SecureString '874219' -AsPlainText -Force)

# Add recovery password protector
Add-BitLockerKeyProtector -MountPoint 'C:' -RecoveryPasswordProtector

# Escrow recovery key to Azure AD (Intune-managed)
$kid = (Get-BitLockerVolume 'C:').KeyProtector |
  Where-Object { $_.KeyProtectorType -eq 'RecoveryPassword' } |
  Select-Object -ExpandProperty KeyProtectorId
BackupToAAD-BitLockerKeyProtector -MountPoint 'C:' -KeyProtectorId $kid

# ── Intune Endpoint Security policy (Disk Encryption) ────────────────────────
{
  "BitLockerEnabled": true,
  "BitLockerSystemDrivePolicy": {
    "EncryptionMethod": "XtsAes256",
    "StartupAuthenticationRequired": true,
    "StartupAuthenticationTpmPinUsage": "Required",
    "MinimumPINLength": 6,
    "RecoveryOptions": {
      "HideRecoveryOptions": true,
      "SaveRecoveryInformationToAD": true
    }
  },
  "BitLockerRemovableDrivePolicy": {
    "RequireEncryption": true,
    "BitLockerDenyWriteAccessToNonBitLockerProtectedRemovableDrives": true
  }
}

# ── Fleet compliance query (PowerShell remoting) ──────────────────────────────
Invoke-Command -ComputerName (Get-ADComputer -Filter * -SearchBase
  'OU=Laptops,DC=hospital,DC=local' | Select-Expand Name) -ScriptBlock {
  Get-BitLockerVolume C: |
  Select PSComputerName, VolumeStatus, ProtectionStatus
} | Export-Csv 'BitLocker_Compliance.csv' -NoTypeInformation

# ── STEP 1  Create Root CA private key and certificate ───────────────────────
openssl genrsa -aes256 -passout pass:CASecurePass! -out ca.key 4096
openssl req -new -x509 -days 3650 \
  -key ca.key -passin pass:CASecurePass! -out ca.crt \
  -subj '/CN=Corp Internal CA/O=Corp Inc/C=US'

# ── STEP 2  Create Intermediate CA (best practice) ────────────────────────────
openssl ecparam -name prime256v1 -genkey -noout -out intermediate.key
openssl req -new -key intermediate.key -out intermediate.csr \
  -subj '/CN=Corp Services CA/O=Corp Inc/C=US'
openssl x509 -req -days 1825 -in intermediate.csr \
  -CA ca.crt -CAkey ca.key -passin pass:CASecurePass! \
  -CAcreateserial -out intermediate.crt \
  -extfile <(printf 'basicConstraints=CA:TRUE\nkeyUsage=keyCertSign,cRLSign')

# ── STEP 3  Issue service certificate for payment-service ─────────────────────
openssl ecparam -name prime256v1 -genkey -noout -out payment-svc.key
openssl req -new -key payment-svc.key -out payment-svc.csr \
  -subj '/CN=payment-service.prod.svc.cluster.local'
openssl x509 -req -days 365 -in payment-svc.csr \
  -CA intermediate.crt -CAkey intermediate.key \
  -CAcreateserial -out payment-svc.crt \
  -extfile <(printf 'subjectAltName=DNS:payment-service.prod.svc.cluster.local\n
   keyUsage=digitalSignature,keyEncipherment\nextendedKeyUsage=serverAuth,clientAuth')

# ── STEP 4  Validate the full certificate chain ───────────────────────────────
openssl verify -CAfile <(cat ca.crt intermediate.crt) payment-svc.crt
# payment-svc.crt: OK

# ── STEP 5  Test mTLS — order-service authenticating to payment-service ───────
openssl s_client -connect payment-service:8443 \
  -cert order-service.crt -key order-service.key \
  -CAfile <(cat ca.crt intermediate.crt) \
  -verify_return_error -verify_hostname payment-service

# ── STEP 6  Encrypt a secrets file at rest ────────────────────────────────────
openssl enc -aes-256-gcm -pbkdf2 -iter 600000 \
  -in secrets.yaml -out secrets.yaml.enc \
  -pass file:/run/secrets/enc_key

# ── STEP 1  Generate a developer GPG key pair (Ed25519) ──────────────────────
gpg --full-generate-key
# Select: (9) ECC / (1) Curve 25519 / 2y expiry
# Name: Dev Name | Email: dev@corp.com

# List key and get fingerprint
gpg --list-secret-keys --keyid-format=long
# sec   ed25519/ABCDEF1234567890  2024-06-17 [SC]

# ── STEP 2  Export public key to GitHub ───────────────────────────────────────
gpg --armor --export ABCDEF1234567890
# Paste into GitHub > Settings > SSH and GPG Keys > New GPG Key

# ── STEP 3  Configure Git global signing ──────────────────────────────────────
git config --global user.signingkey ABCDEF1234567890
git config --global commit.gpgsign true
git config --global tag.gpgsign true

# ── STEP 4  Commit and verify signature ───────────────────────────────────────
git add .
git commit -m 'Add payment processing module v2.1'
git verify-commit HEAD
# gpg: Good signature from 'Dev Name <dev@corp.com>'

# ── STEP 5  Sign and publish a release tarball ────────────────────────────────
tar czf myapp-v2.1.0.tar.gz myapp-v2.1.0/
gpg --armor --detach-sign myapp-v2.1.0.tar.gz
# Creates: myapp-v2.1.0.tar.gz.asc (detached signature file)

# ── STEP 6  End user verifies the release download ────────────────────────────
gpg --import releases@corp.com_public_key.asc
gpg --verify myapp-v2.1.0.tar.gz.asc myapp-v2.1.0.tar.gz
# gpg: Good signature from 'Release Bot <releases@corp.com>'

# ── STEP 7  Encrypt a sensitive report for specific recipients ────────────────
gpg --encrypt --armor \
  --recipient ciso@corp.com \
  --recipient security-lead@corp.com \
  incident_report_2024.pdf

# ── FileVault CLI and Jamf Pro management ─────────────────────────────────────
# Enable FileVault locally (macOS CLI)
sudo fdesetup enable -user admin \
  -outputplist /private/tmp/fv_recovery.plist
# Restart required to begin encryption

# Check FileVault status
sudo fdesetup status
# FileVault is On.

# ── Jamf Pro Configuration Profile ────────────────────────────────────────────
# Computers > Configuration Profiles > New > FileVault Payload
# Enable FileVault:       YES
# Defer until next login: YES  (avoids forced immediate reboot)
# Show recovery key:      NO   (escrowed to Jamf)
# Recovery key type:      Redirect to Jamf (institutional key)

# ── Jamf Pro API — query FileVault status fleet-wide ─────────────────────────
curl -s -u 'admin:JamfAdmin2024!' \
  'https://jamf.corp.com:8443/JSSResource/computers/id/42/subset/FileVault2' \
  -H 'Accept: application/json' \
  | python3 -c "import sys,json;d=json.load(sys.stdin);
fv=d.get('computer',{}).get('file_vault_2',{});
print(fv.get('file_vault_2_status','Unknown'))"

# Retrieve recovery key for a locked device (helpdesk)
curl -s -u 'admin:JamfAdmin2024!' \
  'https://jamf.corp.com:8443/JSSResource/computers/id/42/FileVault2RecoveryKey' \
  -H 'Accept: application/json'

# Remote wipe — Secure Enclave key destroyed in seconds
curl -s -u 'admin:JamfAdmin2024!' -X POST \
  'https://jamf.corp.com:8443/JSSResource/computercommands/command/EraseDevice/id/42'

# ── Cryptomator CLI — vault creation and management ───────────────────────────
# Create a new encrypted vault in the Dropbox folder
cryptomator-cli create \
  --password 'VaultMaster2024!Secure' \
  '/home/user/Dropbox/ClientVault'

# Unlock (mount) the vault as /mnt/ClientVault
cryptomator-cli unlock \
  --password 'VaultMaster2024!Secure' \
  --mountpoint '/mnt/ClientVault' \
  '/home/user/Dropbox/ClientVault'

# Work normally — files written here are encrypted automatically
cp 'ClientReport_Q2_2024.pdf' '/mnt/ClientVault/Reports/Q2/'

# Verify what Dropbox actually stores (random-named ciphertext)
ls '/home/user/Dropbox/ClientVault/d/AB/'
# KLMNOPQRSTUVWXYZ123456789.c9r   (encrypted binary — no readable name)

# Confirm no plaintext files exist in the Dropbox folder
find '/home/user/Dropbox/ClientVault' -name '*.pdf' 2>/dev/null
# Expected: 0 results — all readable files accessed via the virtual drive

# Lock the vault when work is complete
cryptomator-cli lock '/home/user/Dropbox/ClientVault'

# Verify vault integrity
cryptomator-cli check '/home/user/Dropbox/ClientVault'

# ── Dropbox E2EE (Boxcryptor technology) — configuration ─────────────────────
# Create an E2EE folder via Dropbox API
curl -X POST 'https://api.dropboxapi.com/2/files/create_folder_v2' \
  -H 'Authorization: Bearer DBX_ACCESS_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"path":"/ClinicalTrials_E2EE","autorename":false}'

# ── Legacy Boxcryptor Enterprise — Group Policy enforcement ───────────────────
# GPO: Computer Config > Admin Templates > Boxcryptor
# Company Key:         Enforce — all files use company key
# Personal Keys:       Disabled
# Filename Encryption: Enabled
# Require MFA:         Yes (TOTP or hardware key)
# Auto-Logout:         30 minutes idle

# List Dropbox E2EE folder contents via API (metadata only — no content)
curl -X POST 'https://api.dropboxapi.com/2/files/list_folder' \
  -H 'Authorization: Bearer DBX_ACCESS_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"path":"/ClinicalTrials_E2EE","recursive":false}'
# Returns: file metadata only — Dropbox cannot read file contents

# Legacy Boxcryptor CLI — encrypt existing files
BoxcryptorCLI.exe --encrypt \
  --source 'C:\ClinicalData\Trial2024_RawData.xlsx' \
  --destination 'D:\Dropbox\ClinicalTrials_E2EE\' \
  --policy Company

# Verify encryption (file should be unreadable without Boxcryptor)
file 'D:\Dropbox\ClinicalTrials_E2EE\Trial2024_RawData.xlsx.bc'
# Output: data (binary — not a valid XLSX)

# ── TrueCrypt forensic analysis (authorised investigation only) ───────────────
# Step 1: Identify TrueCrypt containers (no file magic — identify by structure)
xxd suspect_volume.tc | head -4
# All random-looking bytes — no file signature (by design)
stat suspect_volume.tc | grep Size
# Size must be multiple of 512 bytes (TrueCrypt sector alignment)

# Step 2: Forensic hash for chain of custody
sha256sum suspect_volume.tc > container_hash_evidence.txt
echo "Hashed: $(date)" >> chain_of_custody.log

# Step 3: RAM forensics — attempt TrueCrypt key recovery
# (RAM image captured at time of seizure via DumpIt or WinPMEM)
vol3 -f memory_image.raw windows.truecrypt.TrueCryptMaster
vol3 -f memory_image.raw windows.truecrypt.TrueCryptPassphrase
vol3 -f memory_image.raw windows.truecrypt.TrueCryptSummary

# Step 4: If passphrase found — mount for forensic imaging
# truecrypt --text --mount suspect_volume.tc /mnt/evidence \
#   --password='RECOVERED_PASSPHRASE' --protect-hidden=no
dd if=/dev/mapper/truecrypt1 of=/evidence/decrypted_image.raw bs=4M

# Step 5: Dictionary attack (if no RAM key found)
truecrack -t suspect_volume.tc \
  -w /usr/share/wordlists/rockyou.txt \
  --hash-type sha512 --encryption-type aes

# Step 6: Document methodology for court report
echo 'TrueCrypt 7.1a format | SHA-256: [hash] | Date: '$(date) \
  >> forensic_report.txt

# ── DiskCryptor CLI (dccon.exe) — encryption management ──────────────────────
# List available disks and partitions
dccon -lst
# 0:0 - System C: (250GB) [Not Encrypted]
# 0:1 - Data   D: (500GB) [Not Encrypted]
# 1:0 - USB    E: (64GB)  [Not Encrypted]

# Encrypt data volume D: with AES-256-XTS
dccon -en 0:1 -p 'DataEncPass2024!HIPAA' -a aes -m xts -wipe 0
# -wipe 0: no pre-wipe (faster); use -wipe 3 for NIST secure wipe

# Encrypt system volume C: — installs pre-boot bootloader
dccon -en 0:0 -p 'SysBootPass2024!Clinic' -a aes -m xts
# Restart required — DiskCryptor bootloader now controls pre-boot auth

# Add USB keyfile for two-factor pre-boot authentication
# DiskCryptor GUI: Tools > Manage Keyfiles > Add Keyfile
# Keyfile path: E:\auth\clinic.key  (stored on admin USB only)
# Result: boot requires BOTH USB keyfile AND passphrase

# Check encryption status
dccon -info 0:0
# Encrypted: YES | Algorithm: AES-256 | Mode: XTS | Status: Mounted

# Batch deployment for 45 workstations via psexec
for /f %%C in (clinic_workstations.txt) do (
  psexec \\%%C -s dccon.exe -en 0:1 \
    -p 'DataEncPass2024!HIPAA' -a aes -m xts -wipe 0
)

# ── Recorded Future API — comprehensive threat enrichment ────────────────────
# Query IP risk score, categories, and associated threat actors
curl -H 'X-RFToken: RF_API_TOKEN' \
  'https://api.recordedfuture.com/v2/ip/203.0.113.45?
  fields=risk,entity,relatedEntities,timestamps,intelCard' \
  | python3 -c "
import sys, json
d = json.load(sys.stdin)['data']
print(f'Risk Score:  {d[\"risk\"][\"score\"]}')
print(f'Criticality: {d[\"risk\"][\"criticalityLabel\"]}')
actors = [e['name'] for e in d.get('relatedEntities',[]) if e.get('type')=='ThreatActor']
print(f'Threat Actors: {actors}')"

# Retrieve Lazarus Group threat actor profile and TTPs
curl -H 'X-RFToken: RF_API_TOKEN' \
  'https://api.recordedfuture.com/v2/threatactor?
  freetext=Lazarus+Group&fields=name,mitreAttack,targetedIndustries,ttps'

# Find CVEs actively exploited by Lazarus Group
curl -H 'X-RFToken: RF_API_TOKEN' \
  'https://api.recordedfuture.com/v2/vulnerability?
  freetext=Lazarus&fields=cve,riskScore,exploitStatuses&limit=10'

# SPL: Show all high-risk external connections today
index=firewall action=allowed dest_ip=*
| lookup rf_ip_lookup ip AS dest_ip OUTPUT rf_risk_score
| where rf_risk_score > 75
| stats count BY src_ip, dest_ip, rf_risk_score, dest_port
| sort -rf_risk_score

# ── ThreatConnect API v3 — intelligence management ───────────────────────────
# Authenticate with HMAC-SHA256
TC_TIMESTAMP=$(date +%s)
TC_SIG=$(echo -n "/v3/indicators:GET:$TC_TIMESTAMP" \
  | openssl dgst -sha256 -hmac 'SECRET_KEY' -binary | base64)

# Query high-confidence malicious IPs from last 24 hours
curl -H "Authorization: TC $ACCESS_ID:$TC_SIG" \
  -H "Timestamp: $TC_TIMESTAMP" \
  'https://api.threatconnect.com/v3/indicators?
  tql=type%3DAddress+AND+confidence%3E%3D80+AND+rating%3E%3D4
  &fields=summary,confidence,rating,associatedGroups&resultLimit=500'

# Import FS-ISAC STIX bundle via TAXII 2.1
curl 'https://tc.threatconnect.com/api/v3/taxii/taxii2/
  collection/fs-isac-feed/objects/' \
  -H 'Authorization: Bearer TAXII_TOKEN' \
  -H 'Accept: application/taxii+json;version=2.1'

# Python SDK — automated indicator processing
from threatconnect import ThreatConnect
tc = ThreatConnect('ACCESS_ID','SECRET_KEY','MyOrg',
                   'https://api.threatconnect.com')
indicators = tc.indicators()
filter1 = indicators.add_filter()
filter1.add_rating_filter(4, '>=')
filter1.add_confidence_filter(80, '>=')
for ind in indicators:
    print(f'{ind.type}: {ind.summary} | Rating: {ind.rating}')

# ── Anomali ThreatStream API — intelligence management ───────────────────────
# Query recent high-confidence malicious IPs
curl -u 'username:api_key' \
  'https://api.threatstream.com/api/v2/intelligence/?
  confidence__gte=80&itype=mal_ip&
  modified_ts__gte=2024-06-16T00:00:00Z&
  limit=500&format=json&order_by=-modified_ts'

# Subscribe to H-ISAC STIX/TAXII feed
curl -u 'username:api_key' -X POST \
  'https://api.threatstream.com/api/v1/import/taxii/' \
  -H 'Content-Type: application/json' \
  -d '{"url":"https://taxii.h-isac.org/taxii2/",
       "collection":"healthcare-threats",
       "username":"HISAC_USER","password":"HISAC_PASS",
       "poll_interval":900}'

# Export confirmed malicious IPs for firewall blocklist
curl -u 'username:api_key' \
  'https://api.threatstream.com/api/v2/intelligence/export/?
  confidence__gte=90&itype=mal_ip&format=csv&limit=5000' \
  -o /tmp/malicious_ips_$(date +%Y%m%d).csv

# Map campaign TTPs to MITRE ATT&CK for coverage gap analysis
curl -u 'username:api_key' \
  'https://api.threatstream.com/api/v2/campaign/?
  name=BlackCat_Healthcare_2024
  &fields=name,actors,indicators,mitre_attack_techniques'

# Push blocklist to Splunk lookup table
python3 -c "
import csv, splunklib.client as client
sp = client.connect(host='splunk.corp.local',
                    username='admin', password='Pass')
with open('/tmp/malicious_ips_20240617.csv') as f:
    sp.kvstore['threat_ip_blocklist'].data.batch_save(
        *[{'ip': r['value']} for r in csv.DictReader(f)])"

# ── IBM X-Force Exchange API — threat intelligence queries ────────────────────
# Query IP reputation
curl -u 'API_KEY:API_PASSWORD' -H 'Accept: application/json' \
  'https://api.xforce.ibmcloud.com/ipr/45.142.212.100' \
  | python3 -c "
import sys, json
d = json.load(sys.stdin)
print(f'IP:         {d[\"ip\"]}')
print(f'Score:      {d[\"score\"]}/10')
print(f'Categories: {list(d.get(\"cats\",{}).keys())}')"

# Query URL category and reputation
curl -u 'API_KEY:API_PASSWORD' \
  'https://api.xforce.ibmcloud.com/url/http://phishing-site.xyz/login'

# Retrieve malware report by SHA-256 hash
curl -u 'API_KEY:API_PASSWORD' \
  'https://api.xforce.ibmcloud.com/malware/SHA256_HASH'

# Search vulnerability advisories (Log4j)
curl -u 'API_KEY:API_PASSWORD' \
  'https://api.xforce.ibmcloud.com/vulnerabilities/search?
  q=log4j&startDate=2021-12-01&endDate=2022-03-31'

# ── QRadar integration — automatic offense enrichment ────────────────────────
# QRadar > Admin > Extension Management > X-Force Exchange App
# API Key + Password from X-Force Exchange profile
# Auto-enrich offenses: YES | Threshold: All offenses with remote IP
# After configuration, all QRadar offenses show:
# Source IP Risk Score: 9.2/10
# Category: Botnet, C2
# Related Malware: TrickBot, Emotet
# Threat Actor: TA542 (Emotet operators)

pip install OTXv2

from OTXv2 import OTXv2, IndicatorTypes
import os

otx = OTXv2('YOUR_OTX_API_KEY')

def check_ip(ip):
    try:
        d = otx.get_indicator_details_full(IndicatorTypes.IPv4, ip)
        count   = d['general']['pulse_info']['count']
        pulses  = d['general']['pulse_info']['pulses'][:5]
        threats = [p['name'] for p in pulses]
        return {'ip': ip, 'pulse_count': count, 'threats': threats,
                'high_risk': count >= 3}
    except Exception as e:
        return {'ip': ip, 'error': str(e), 'high_risk': False}

# Process suspicious IPs extracted from firewall logs
suspicious_ips = ['185.220.101.35', '45.142.212.100', '194.165.16.72']
for ip in suspicious_ips:
    result = check_ip(ip)
    if result['high_risk']:
        print(f'[BLOCK] {ip} | Pulses: {result["pulse_count"]} | {result["threats"]}')
        os.system(f'iptables -I INPUT -s {ip} -j DROP')
    else:
        print(f'[ALLOW] {ip} | Pulses: {result.get("pulse_count",0)}')

# Subscribe to a specific threat Pulse
otx.subscribe_to_pulse('PULSE_UUID_COBALT_STRIKE_C2')

# Retrieve all subscribed Pulse IPs for a blocklist
subscribed = otx.getall()
all_ips = [i['indicator'] for p in subscribed
           for i in p.get('indicators',[]) if i['type']=='IPv4']
print(f'Total IPs to block from subscriptions: {len(all_ips)}')

# ── Mandiant Advantage API — threat intelligence ──────────────────────────────
# Authenticate (OAuth2 client credentials)
TOKEN=$(curl -s -X POST \
  'https://api.intelligence.mandiant.com/token' \
  -d 'grant_type=client_credentials
      &client_id=CLIENT_ID&client_secret=CLIENT_SECRET' \
  | python3 -c "import sys,json;print(json.load(sys.stdin)['access_token'])")

# Query APT41 threat actor profile
curl -H "Authorization: Bearer $TOKEN" -H 'Accept: application/json' \
  'https://api.intelligence.mandiant.com/v4/actor?name=APT41&limit=1' \
  | python3 -c "
import sys, json
a = json.load(sys.stdin)['threat-actors'][0]
print(f'Actor: {a[\"name\"]} | Industries: {a.get(\"industries\")}')"

# Retrieve current APT41 indicators (IPs, domains, hashes)
curl -H "Authorization: Bearer $TOKEN" \
  'https://api.intelligence.mandiant.com/v4/indicator?
  threat_actors=APT41&type=ip-dst&limit=200'

# Check vulnerability exploitation likelihood
curl -H "Authorization: Bearer $TOKEN" \
  'https://api.intelligence.mandiant.com/v4/vulnerability?
  cve_id=CVE-2024-21762&include_actor_data=true'

# Query PlugX malware family analysis
curl -H "Authorization: Bearer $TOKEN" \
  'https://api.intelligence.mandiant.com/v4/malware?
  name=PlugX&include_campaign_info=true'

# ── AutoFocus API — malware and indicator intelligence ────────────────────────
# Search for a file hash in the WildFire global database
curl -X POST \
  'https://autofocus.paloaltonetworks.com/api/v1.0/samples/search' \
  -H 'apiKey: AF_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"query":{"operator":"all","children":[{
        "field":"sample.sha256","operator":"is",
        "value":"a1b2c3d4e5f6g7h8..."}]},
       "scope":"global","size":10}'

# Get full analysis (Unit 42 tags, behaviours, network IoCs)
curl -X POST \
  'https://autofocus.paloaltonetworks.com/api/v1.0/sample/SHA256/analysis' \
  -H 'apiKey: AF_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"coverage":true,"platforms":["win10","winxp"]}'

# Search all samples tagged as Lazarus Group by Unit 42
curl -X POST \
  'https://autofocus.paloaltonetworks.com/api/v1.0/samples/search' \
  -H 'apiKey: AF_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"query":{"operator":"all","children":[{
        "field":"sample.tag","operator":"contains",
        "value":"Unit42.LazarusGroup"}]},
       "scope":"global","size":50}'

# MineMeld: push AutoFocus IoCs to PAN NGFW External Dynamic List
# MineMeld config: autofocus_source -> dedup_processor -> panos_output
# PAN NGFW: Objects > External Dynamic Lists > poll MineMeld every 5 min

# ── SPL correlation rules for LotL attack detection ──────────────────────────
# Rule 1: PowerShell encoded download cradle (T1059.001)
index=windows EventCode=4688
| regex New_Process_Name="(?i)powershell"
| regex Process_Command_Line="(?i)(-enc|-EncodedCommand)[A-Za-z0-9+/]{50,}"
| regex Process_Command_Line="(?i)(iex|invoke-expression|downloadstring)"
| stats count by host, Account_Name, Process_Command_Line
| where count >= 1
| eval severity="critical"

# Rule 2: Office application spawning PowerShell (T1566.001)
index=windows EventCode=4688
| eval parent=lower(Creator_Process_Name)
| eval child=lower(New_Process_Name)
| where (match(parent,"(winword|excel|powerpnt|outlook)")
  AND match(child,"(powershell|cmd|wscript|cscript|mshta|certutil)"))
| table _time, host, Account_Name, parent, child, Process_Command_Line

# Rule 3: certutil LOLBin download (T1105)
index=windows EventCode=4688
| regex New_Process_Name="(?i)certutil"
| regex Process_Command_Line="(?i)(-urlcache|-f|-split)"
| stats count by host, Account_Name, Process_Command_Line

# Rule 4: Threat intel enrichment — high-risk external connections
index=network src_ip=* dest_ip=* action=allowed
| lookup recordedfuture_ip_risklist ip AS dest_ip OUTPUT risk_score
| where isnotnull(risk_score) AND risk_score > 75
| table _time, src_ip, dest_ip, dest_port, bytes_out, risk_score

# ── LogRhythm REST API — alarm management ─────────────────────────────────────
# Authenticate to LogRhythm API
TOKEN=$(curl -s -X POST \
  'https://lrapi.corp.local/lr-alarm-api/actions/getAlarms' \
  -H 'Content-Type: application/json' \
  -d '{"username":"api_user","password":"ApiPass2024!"}' \
  | python3 -c "import sys,json;print(json.load(sys.stdin)['access_token'])")

# Query critical alarms from last 24 hours
curl -H "Authorization: Bearer $TOKEN" \
  'https://lrapi.corp.local/lr-alarm-api/alarms?
  status=1&priority=5&dateCreatedGte=2024-06-16T00:00:00Z' \
  | python3 -c "
import sys, json
alarms = json.load(sys.stdin)['alarms']
print(f'Critical alarms: {len(alarms)}')
for a in alarms[:5]:
    print(f'  [{a[\"id\"]}] {a[\"name\"]} | Host: {a.get(\"entityName\")}')"

# ── AI Engine rule: Privileged Account Anomalous Logon ────────────────────────
# Rule:   'Privileged Account Lateral Movement'
# Block A: EventID=4624 AND Account=svc_backup
#          AND OriginHost NOT IN [known_servers_list]
# Block B: EventID=4624 AND Account=svc_backup
#          AND LogonHour < 6 OR LogonHour > 22
# Block C: SourceIP NOT IN 10.0.0.0/8 (external source)
# Threshold: Any 2 of 3 blocks within 30-minute window
# Action: Critical alarm + SmartResponse: Disable-ADAccount

# SmartResponse script (auto-executed on alarm)
Disable-ADAccount -Identity svc_backup
Get-ADUser svc_backup | Select Enabled
# Enabled: False — account disabled at 03:17:42 AM

# ── QRadar AQL — threat hunting queries ───────────────────────────────────────
# Detect DNS beaconing (regular high-frequency queries to one domain)
SELECT sourceIP, destinationIP, COUNT(*) as query_count
FROM events
WHERE category = 1
  AND LOGSOURCETYPENAME(logSourceId) = 'WindowsDNS'
  AND starttime > NOW() - 3600000
GROUP BY sourceIP, destinationIP
HAVING query_count > 50
ORDER BY query_count DESC
LAST 1 HOURS

# Detect long DNS query names (tunnelling indicator)
SELECT sourceIP, payloadFirstBytes,
  STRLEN(payloadFirstBytes) as query_len, COUNT(*) as count
FROM events
WHERE LOGSOURCETYPENAME(logSourceId) = 'WindowsDNS'
  AND STRLEN(payloadFirstBytes) > 100
GROUP BY sourceIP, payloadFirstBytes, query_len
HAVING count > 10
LAST 6 HOURS

# Network flow: detect beacon pattern (regular small sessions)
SELECT sourceIP, destinationIP, destinationPort,
  COUNT(*) as flow_count,
  AVG(flowDuration) as avg_duration,
  STDDEV(flowDuration) as variance
FROM flows
WHERE destinationIP NOT IN (RFC1918)
  AND flow_count BETWEEN 20 AND 200
GROUP BY sourceIP, destinationIP, destinationPort
HAVING variance < 500
ORDER BY flow_count DESC
LAST 6 HOURS

# QRadar REST API — assign offense to analyst
curl -k -H 'SEC: ADMIN_TOKEN' -H 'Content-Type: application/json' \
  -X POST 'https://qradar.corp.local/api/siem/offenses/OFFENSE_ID' \
  -d '{"status":"OPEN","assigned_to":"analyst1"}'

# ── TheHive API v4 — case management automation ───────────────────────────────
# Create a phishing campaign case with initial tasks
curl -s -X POST 'https://thehive.corp.local:9000/api/case' \
  -H 'Authorization: Bearer API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "title":       "Phishing Campaign — Finance Team (Jun 2024)",
    "description": "Mass phishing targeting finance staff — DocuSign lure",
    "severity":    3,
    "tlp":         2,
    "tags":        ["phishing","finance","credential-harvesting"],
    "tasks": [
      {"title":"Identify all recipients",   "assignee":"analyst1"},
      {"title":"Analyse attachment hashes", "assignee":"analyst2"},
      {"title":"Block sender domains",      "assignee":"analyst1"},
      {"title":"Reset click-through users", "assignee":"analyst3"}
    ]
  }'

# Add phishing URL as observable for Cortex analysis
curl -s -X POST 'https://thehive.corp.local:9000/api/case/CASE_ID/artifact' \
  -H 'Authorization: Bearer API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "dataType": "url",
    "data":     "https://docusign-secure-login.malicious.xyz/verify",
    "tlp":      2,
    "tags":     ["phishing-url","credential-harvest"]
  }'

# Trigger Cortex analyser (VirusTotal URL lookup)
curl -s -X POST 'https://cortex.corp.local:9001/api/job' \
  -H 'Authorization: Bearer CORTEX_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "analyzerId":         "VirusTotal_GetReport_3_1",
    "artifactType":       "url",
    "artifactDefinition": {"data":"https://docusign-secure-login.malicious.xyz/verify"}
  }'

# ── MISP REST API — event and attribute management ────────────────────────────
# Create a MISP event for an APT campaign
curl -s -X POST 'https://misp.cert.gov/events' \
  -H 'Authorization: API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"Event":{
    "info":           "APT28 Phishing Campaign — Ministry of Finance",
    "threat_level_id": 1,
    "analysis":        2,
    "distribution":    2,
    "Attribute": [
      {"type":"ip-dst","value":"203.0.113.45",
       "to_ids":true,"comment":"C2 server"},
      {"type":"domain","value":"evil-docs.xyz",
       "to_ids":true,"comment":"Phishing domain"},
      {"type":"sha256","value":"a1b2c3...",
       "to_ids":true,"comment":"Dropper hash"},
      {"type":"yara","value":"rule APT28_Dropper {...}",
       "to_ids":false,"comment":"YARA rule"}
    ]
  }}'

# Search all events containing a specific IP
curl -s -X POST 'https://misp.cert.gov/attributes/restSearch' \
  -H 'Authorization: API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"returnFormat":"json","value":"203.0.113.45",
       "type":"ip-dst","to_ids":true}'

# Export event as STIX 2.1 for SIEM ingestion
curl -s 'https://misp.cert.gov/events/restSearch/
  returnFormat:stix2/threat_level_id:1/to_ids:true' \
  -H 'Authorization: API_KEY'

# Subscribe to abuse.ch URLhaus feed
# MISP > Feeds > Add Feed
#   URL: https://urlhaus-api.abuse.ch/v1/urls/recent/
#   Format: MISP Feed JSON | Cache: Every 30 minutes

# ── SIFT Workstation forensic investigation workflow ─────────────────────────
# Step 1: Acquire memory image from live system (via WinPMEM on victim)
scp analyst@victim-server:/C/memory_image.raw /cases/INC-2024-0847/

# Step 2: Create forensic disk image in E01 format
ewfacquire /dev/sdb \
  -t /cases/INC-2024-0847/victim_disk \
  -C 'INC-2024-0847 Victim Server' \
  -e analyst@corp.com \
  -m fixed -M logical

# Step 3: Verify acquisition integrity
ewfverify /cases/INC-2024-0847/victim_disk.E01
# MD5 hash verified: acquisition integrity confirmed

# Step 4: Analyse memory image with Volatility 3
vol3 -f /cases/INC-2024-0847/memory_image.raw windows.pslist.PsList
vol3 -f /cases/INC-2024-0847/memory_image.raw windows.netscan.NetScan
vol3 -f /cases/INC-2024-0847/memory_image.raw windows.cmdline.CmdLine
vol3 -f /cases/INC-2024-0847/memory_image.raw windows.hashdump.Hashdump
vol3 -f /cases/INC-2024-0847/memory_image.raw windows.malfind.Malfind

# Step 5: Build unified super-timeline with log2timeline
log2timeline.py -z UTC \
  --storage-file /cases/INC-2024-0847/timeline.plaso \
  /cases/INC-2024-0847/victim_disk.E01

psort.py -z UTC -o l2tcsv \
  -w /cases/INC-2024-0847/timeline.csv \
  /cases/INC-2024-0847/timeline.plaso

# Step 6: YARA scan against extracted memory regions
vol3 -f memory_image.raw windows.vadyarascan.VadYaraScan \
  --yara-rules /tools/yara-rules/ransomware/*.yar

# ── GRR API — Hunt creation and management ────────────────────────────────────
from grr_api_client import api as grr_api

# Connect to GRR server
grrapi = grr_api.InitHttp(
    api_endpoint='https://grrserver.corp.local:8000',
    auth=('admin', 'GRRAdminPass2024!'))

# Create YARA Hunt across all Windows endpoints
hunt_args = grrapi.types.CreateHuntArgs()
hunt_args.flow_name = 'YaraProcessScan'
hunt_args.flow_args.yara_signature = '''
rule CobaltStrike_ReflectiveDLL {
  strings:
    $s1 = { 52 65 66 6C 65 63 74 69 76 65 4C 6F 61 64 65 72 }
    $s2 = { 4D 65 74 61 73 70 6C 6F 69 74 20 74 65 61 6D }
    $s3 = { 63 6F 62 61 6C 74 73 74 72 69 6B 65 }
  condition: any of them
}
'''
# Restrict Hunt to Windows clients only
hunt_args.client_rule_set.rules.add().os.os_windows = True

hunt = grrapi.CreateHunt(
    flow_name='YaraProcessScan',
    flow_args=hunt_args.flow_args,
    hunt_runner_args=grrapi.types.HuntRunnerArgs(
        description='CobaltStrike YARA Hunt Jun2024',
        client_limit=0,
        expiry_time=grrapi.types.Duration(seconds=3600)))
hunt.Start()
print(f'Hunt started: {hunt.hunt_id}')

# Monitor and retrieve results
import time
while hunt.data.state == 2:  # STARTED
    time.sleep(60)
    hunt = grrapi.Hunt(hunt.hunt_id).Get()
    print(f'Clients checked: {hunt.data.num_clients_with_results}')

for result in grrapi.Hunt(hunt.hunt_id).Results():
    print(f'YARA MATCH: {result.client_id}')

# ── Velociraptor VQL — fleet-wide persistence hunting ────────────────────────
# Custom VQL: hunt for Qbot registry persistence
SELECT
  Hostname,
  Key.ModTime,
  Key.Name  as RunKey,
  Key.Data  as KeyValue
FROM foreach(
  row={SELECT Hostname FROM info()},
  query={
    SELECT ModTime, Name, Data
    FROM read_reg_key(
      globs=['HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\*',
             'HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\*']
    )
    WHERE Data =~ '(?i)(regsvr32|rundll32|mshta|wscript|cscript)'
  }
)

# Hunt for Qbot scheduled task pattern (random 8-char name, base64 cmd)
LET results =
  SELECT client_id, Name, Command
  FROM Artifact.Windows.System.ScheduledTasks()
  WHERE Command =~ '(?i)cmd.*\/c.*powershell.*base64'
    OR Name =~ '^[A-Z]{8}$'
SELECT * FROM results

# Fleet-wide YARA memory scan for Qbot
SELECT * FROM yara(
  rules='''rule Qbot { strings: $s1 = "qbot" nocase condition: $s1 }''',
  pid='*'
)

# Live response: terminate process and collect binary for analysis
LET _ = execve(argv=['taskkill', '/PID', '4521', '/F'])
SELECT upload(file='/Windows/Temp/svchost32.exe') FROM scope()

# ── Carbon Black cbapi — threat hunting and live response ─────────────────────
from cbapi.response import CbResponseAPI, Process
cb = CbResponseAPI(url='https://cbresponse.corp.local',
                   token='CB_API_TOKEN', ssl_verify=True)

# Hunt: PowerShell encoded download cradles (last 30 days)
query = cb.select(Process).where(
    'process_name:powershell.exe AND
     cmdline:encodedcommand AND cmdline:downloadstring'
)
for proc in query:
    print(f'Host:    {proc.hostname}')
    print(f'Time:    {proc.start}')
    print(f'CmdLine: {proc.cmdline}')
    print(f'Parent:  {proc.parent.process_name}')
    print('---')

# Find all external network connections from suspicious processes
for proc in cb.select(Process).where(
    'process_name:powershell.exe AND netconn_count:[1 TO *]'
):
    for nc in proc.netconns:
        if not nc.remote_ip.startswith(('10.','192.168.','172.')):
            print(f'External C2: {nc.remote_ip}:{nc.remote_port}')

# Live Response: collect malicious binary and terminate process
sensor = cb.select('Sensor').where('hostname:DESKTOP-FINANCE-14').first()
with sensor.lr_session() as lr:
    lr.get_file(r'C:\Windows\Temp\svchost32.exe', '/evidence/svchost32.exe')
    lr.kill_process(4521)     # terminate malicious process
    lr.delete_file(r'C:\Windows\Temp\svchost32.exe')

# ── Cybereason API — MalOp investigation and response ────────────────────────
# Authenticate to Cybereason platform
curl -s -c cookies.txt -X POST \
  'https://cybereason.corp.local:8443/login.html' \
  -d 'username=admin&password=CybAdminPass2024!'

# Retrieve all open MalOps
curl -s -b cookies.txt -X POST \
  'https://cybereason.corp.local:8443/rest/crimes/unified?
  crimeStatus=UNRESOLVED' \
  -H 'Content-Type: application/json' \
  -d '{"templateContext":"OVERVIEW",
       "filters":[{"fieldName":"malopActivityTypes",
       "operator":"ContainsAnyOf",
       "values":["RANSOMWARE","MALICIOUS_INFECTION"]}]}'

# Get full MalOp details (timeline, machines, root cause)
curl -s -b cookies.txt -X POST \
  'https://cybereason.corp.local:8443/rest/crimes/unified' \
  -H 'Content-Type: application/json' \
  -d '{"guidList":["MALOP_GUID"],"templateContext":"DETAILS"}'

# Isolate all machines involved in the MalOp
curl -s -b cookies.txt -X POST \
  'https://cybereason.corp.local:8443/rest/sensors/action' \
  -H 'Content-Type: application/json' \
  -d '{"action":"ISOLATE",
       "filters":[{"fieldName":"malopGuid",
       "operator":"ContainsAnyOf",
       "values":["MALOP_GUID"]}]}'

# One-click remediation: kill malicious processes
curl -s -b cookies.txt -X POST \
  'https://cybereason.corp.local:8443/rest/remediate' \
  -H 'Content-Type: application/json' \
  -d '{"malopId":"MALOP_GUID",
       "remediationItems":[{"actionType":"KILL_PROCESS",
       "elementType":"PROCESS",
       "elementValues":["PROCESS_ID_1","PROCESS_ID_2"]}]}'

# ── IBM Resilient / QRadar SOAR API — incident management ────────────────────
# Authenticate to Resilient
curl -s -X POST 'https://resilient.corp.local/rest/session' \
  -H 'Content-Type: application/json' \
  -d '{"email":"admin@corp.com","password":"ResilientAdmin2024!"}'

# Create a ransomware incident
curl -s -X POST \
  'https://resilient.corp.local/rest/orgs/ORG_ID/incidents' \
  -H 'Authorization: BasicWithSession API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "name":              "BlackCat Ransomware — Finance Server Farm",
    "incident_type_ids": [12],
    "severity_code":     {"name":"High"},
    "description":       "BlackCat/ALPHV on 8 finance servers",
    "properties": {
      "affected_countries": ["US","UK"],
      "data_compromised":   true,
      "pii_involved":       true,
      "employee_count":     847
    }
  }'

# The Ransomware Response Playbook auto-executes:
# 1. Enrich C2 IPs via Recorded Future
# 2. CrowdStrike: isolate all affected endpoints
# 3. PagerDuty: alert on-call IR lead
# 4. Slack: notify #incident-response
# 5. Calculate GDPR Article 33 72-hour notification obligation
# 6. ServiceNow: create P1 ticket for vendor notification
# 7. Document timeline entry for each automated action

# Add a task for the IR team
curl -s -X POST \
  'https://resilient.corp.local/rest/orgs/ORG_ID/incidents/INC_ID/tasks' \
  -H 'Authorization: BasicWithSession API_KEY' \
  -d '{"name":"Forensic image all affected servers","owner_id":42}'

# ── Cofense Triage API — automated phishing processing ───────────────────────
# Authenticate to Cofense Triage
TOKEN=$(curl -s -X POST \
  'https://triage.corp.local/api/oauth/token' \
  -d 'grant_type=client_credentials
      &client_id=CLIENT_ID&client_secret=CLIENT_SECRET' \
  | python3 -c "import sys,json;print(json.load(sys.stdin)['access_token'])")

# Get all unprocessed phishing reports
curl -s 'https://triage.corp.local/api/public/v2/reports?
  filter[report_type]=phishing&filter[match_priority]=0' \
  -H "Authorization: Bearer $TOKEN"

# Get all email clusters from today
curl -s 'https://triage.corp.local/api/public/v2/clusters?
  filter[created_at_gteq]=2024-06-17T00:00:00Z' \
  -H "Authorization: Bearer $TOKEN" \
  | python3 -c "
import sys, json
clusters = json.load(sys.stdin)['data']
print(f'Clusters today: {len(clusters)}')
for c in clusters:
    print(f'  {c[\"id\"]}: priority {c[\"attributes\"][\"match_priority\"]}
  — {c[\"attributes\"][\"report_count\"]} reports')"

# Mark a cluster as malicious (triggers auto-quarantine)
curl -s -X PATCH \
  'https://triage.corp.local/api/public/v2/clusters/CLUSTER_ID' \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"data":{"type":"clusters","id":"CLUSTER_ID",
       "attributes":{"match_priority":1}}}'

# Vision: retroactively find and quarantine all similar emails
curl -s -X POST \
  'https://triage.corp.local/api/public/v2/searches' \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"data":{"type":"searches",
       "attributes":{"cluster_id":"CLUSTER_ID","auto_quarantine":true}}}'

# ── D3 Security REST API — incident and playbook management ──────────────────
# Authenticate to D3 Smart SOAR
TOKEN=$(curl -s -X POST \
  'https://d3soar.corp.local/api/login' \
  -H 'Content-Type: application/json' \
  -d '{"username":"admin","password":"D3Admin2024!"}' \
  | python3 -c "import sys,json;print(json.load(sys.stdin)['token'])")

# Create an incident and attach the Ransomware Response playbook
curl -s -X POST 'https://d3soar.corp.local/api/incidents' \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{
    "name":     "BlackCat Ransomware — Finance Department",
    "severity": "Critical",
    "category": "Ransomware",
    "source":   "CrowdStrike Falcon",
    "assets":   ["FINANCE-SRV-01","FINANCE-SRV-02","FINANCE-WS-07"],
    "playbook": "Ransomware_Response_v3"
  }'

# Ransomware_Response_v3 playbook executes automatically:
# Step 1:  Enrich all IPs/hashes via Recorded Future    (automated)
# Step 2:  CrowdStrike isolate all listed assets         (automated)
# Step 3:  Palo Alto block all C2 IPs at perimeter      (automated)
# Step 4:  Notify CISO via Slack                        (automated)
# Step 5:  Create ServiceNow P1 ticket                  (automated)
# Step 6:  DECISION: pay or decline ransom              (manual gate)
# Step 7:  Calculate GDPR/regulatory obligations        (automated)
# Step 8:  Draft breach notification letters            (automated)
# Step 9:  Preserve forensic evidence                   (automated)
# Step 10: Generate post-incident report                (automated)

# Retrieve incident metrics after closure
curl -s 'https://d3soar.corp.local/api/incidents/INC_ID/metrics' \
  -H "Authorization: Bearer $TOKEN" \
  | python3 -c "
import sys, json
m = json.load(sys.stdin)
print(f'MTTD: {m[\"mttd_minutes\"]} min | MTTR: {m[\"mttr_minutes\"]} min')
print(f'Automated: {m[\"automated_steps\"]} steps | Manual: {m[\"manual_steps\"]}')"