THEHIVE_URL='https://thehive.corp.local:9000'
API_KEY='YOUR_THEHIVE_API_KEY'

# Step 1: Create phishing campaign case with pre-assigned tasks
curl -s -X POST "$THEHIVE_URL/api/case" \
  -H "Authorization: Bearer $API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "title":       "Phishing Campaign — Finance Dept Jun 2024",
    "description": "DocuSign-lure targeting 50 finance staff",
    "severity":3,"tlp":2,"pap":2,
    "tags":["phishing","finance","credential-harvest"],
    "tasks":[
      {"title":"Identify all recipients","assignee":"analyst1"},
      {"title":"Analyse attachment hashes","assignee":"analyst2"},
      {"title":"Block sender domains at GW","assignee":"analyst1"},
      {"title":"Reset click-through passwords","assignee":"analyst3"},
      {"title":"Export IoCs to MISP","assignee":"analyst2"}
    ]
  }'

# Step 2: Add phishing URL as observable
curl -s -X POST "$THEHIVE_URL/api/case/CASE_ID/artifact" \
  -H "Authorization: Bearer $API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"dataType":"url","data":"https://docusign-verify.malicious.xyz/login","tlp":2,"ioc":true}'

# Step 3: Trigger VirusTotal Cortex analyser
curl -s -X POST 'https://cortex.corp.local:9001/api/job' \
  -H "Authorization: Bearer $API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"analyzerId":"VirusTotal_GetReport_3_1","artifactType":"url",
       "artifactDefinition":{"data":"https://docusign-verify.malicious.xyz/login"}}'

# Step 4: Close case with resolution summary
curl -s -X PATCH "$THEHIVE_URL/api/case/CASE_ID" \
  -H "Authorization: Bearer $API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"status":"Resolved","resolutionStatus":"TruePositive",
       "summary":"Confirmed phishing. 4 click-throughs; passwords reset; 23 IoCs to MISP."}'

MISP_URL='https://misp.cert.gov'
MISP_KEY='YOUR_MISP_API_KEY'

# Create MISP event for APT28 campaign
curl -s -X POST "$MISP_URL/events" \
  -H "Authorization: $MISP_KEY" -H 'Content-Type: application/json' \
  -d '{"Event":{"info":"APT28 Spear-Phishing — Gov Ministries Jun 2024",
    "threat_level_id":"1","analysis":"2","distribution":"2",
    "Attribute":[
      {"type":"ip-dst","value":"203.0.113.45","to_ids":true,"comment":"APT28 C2 server"},
      {"type":"domain","value":"gov-update.malicious.xyz","to_ids":true},
      {"type":"sha256","value":"a1b2c3d4e5f678...","to_ids":true,"comment":"X-Agent dropper"},
      {"type":"email-src","value":"updates@gov-secure.malicious.xyz","to_ids":true}
    ]}}'

# Apply MITRE ATT&CK Galaxy tag
curl -s -X POST "$MISP_URL/events/addTag/EVENT_ID" \
  -H "Authorization: $MISP_KEY" \
  -d 'tag=misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.001"'

# Search all events for specific IP
curl -s -X POST "$MISP_URL/attributes/restSearch" \
  -H "Authorization: $MISP_KEY" -H 'Content-Type: application/json' \
  -d '{"returnFormat":"json","value":"203.0.113.45","type":"ip-dst","to_ids":true}'

# Export as STIX 2.1 for SIEM ingestion
curl -s "$MISP_URL/events/restSearch/returnFormat:stix2/threat_level_id:1/to_ids:true" \
  -H "Authorization: $MISP_KEY"

# Add Sighting — confirm real-world observation
curl -s -X POST "$MISP_URL/sightings/add" \
  -H "Authorization: $MISP_KEY" -H 'Content-Type: application/json' \
  -d '{"value":"203.0.113.45","type":"0","source":"SIEM_FW_Alert_INC-2024-0847"}'

CASE='/cases/INC-2024-0847'
mkdir -p $CASE/evidence $CASE/analysis $CASE/reports

# PHASE 1: ACQUISITION
scp analyst@victim-srv:/C/memory_VICTIM-SRV_20240617.raw $CASE/evidence/

ewfacquire /dev/sdb \
  -t $CASE/evidence/disk_VICTIM-SRV \
  -C 'INC-2024-0847 Victim Server' \
  -e analyst@corp.com \
  -m fixed -M logical -c best

ewfverify $CASE/evidence/disk_VICTIM-SRV.E01
# MD5 hash verified — acquisition integrity confirmed

# PHASE 2: MEMORY ANALYSIS (Volatility 3)
MEMFILE="$CASE/evidence/memory_VICTIM-SRV_20240617.raw"
vol3 -f $MEMFILE windows.info.Info         | tee $CASE/analysis/os_info.txt
vol3 -f $MEMFILE windows.pslist.PsList     | tee $CASE/analysis/pslist.txt
vol3 -f $MEMFILE windows.malfind.Malfind   | tee $CASE/analysis/malfind.txt
vol3 -f $MEMFILE windows.netscan.NetScan   | grep -v CLOSED | tee $CASE/analysis/netscan.txt
vol3 -f $MEMFILE windows.cmdline.CmdLine   | tee $CASE/analysis/cmdline.txt
vol3 -f $MEMFILE windows.hashdump.Hashdump | tee $CASE/analysis/hashes.txt

# YARA scan for BlackCat ransomware
vol3 -f $MEMFILE windows.vadyarascan.VadYaraScan \
  --yara-rules /opt/yara-rules/ransomware/blackcat.yar

# PHASE 3: SUPERTIMELINE
log2timeline.py -z UTC \
  --storage-file $CASE/analysis/timeline.plaso \
  $CASE/evidence/disk_VICTIM-SRV.E01

psort.py -z UTC -o l2tcsv \
  -w $CASE/analysis/timeline_filtered.csv \
  $CASE/analysis/timeline.plaso \
  "date > '2024-06-12' AND date < '2024-06-18'" 

from grr_api_client import api as grr_api
import time

grrapi = grr_api.InitHttp(
    api_endpoint='https://grrserver.corp.local:8000',
    auth=('admin', 'GRRAdminPass2024!'))

YARA_RULE = '''
rule BlackCat_ALPHV_Loader {
  meta: author = "CorpSOC"
  strings:
    $s1 = "alphv" nocase wide ascii
    $s2 = { 42 6C 61 63 6B 43 61 74 }
    $s3 = "Salsa20" nocase
  condition: 2 of them
}
'''

hunt = grrapi.CreateHunt(
    flow_name='YaraProcessScan',
    flow_args=grrapi.types.YaraProcessScan(
        yara_signature=YARA_RULE, scan_runtime_us=60000000),
    hunt_runner_args=grrapi.types.HuntRunnerArgs(
        description='BlackCat YARA Hunt Jun2024',
        client_limit=0,
        expiry_time=grrapi.types.Duration(seconds=3600)))
hunt.Start()
print(f'Hunt started: {hunt.hunt_id}')

while True:
    h = grrapi.Hunt(hunt.hunt_id).Get()
    print(f'Clients: {h.data.all_clients_count} | Hits: {h.data.num_clients_with_results}')
    if h.data.state == 3: break
    time.sleep(30)

print('Compromised endpoints:')
for r in grrapi.Hunt(hunt.hunt_id).Results():
    print(f'  YARA MATCH: {r.client_id}')

# HUNT 1: Qbot registry Run key persistence (VQL Hunt to all 500 endpoints)
SELECT
  client_info().Hostname AS Hostname,
  Key.ModTime AS LastModified, Key.Name AS RunKeyName, Key.Data.value AS CommandValue
FROM foreach(
  row={SELECT * FROM clients()},
  query={
    SELECT ModTime, Name, Data FROM read_reg_key(
      globs=['HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Run/*',
             'HKCU/SOFTWARE/Microsoft/Windows/CurrentVersion/Run/*'])
    WHERE Data.value =~ '(?i)(regsvr32|rundll32|mshta|wscript)'
    AND   Data.value =~ '(?i)(Temp|AppData|ProgramData)'
  })

# HUNT 2: Qbot scheduled task (random name with base64 cmd)
SELECT client_info().Hostname AS Hostname, Name, Command, Arguments, User, Enabled
FROM Artifact.Windows.System.ScheduledTasks()
WHERE (Command =~ '(?i)(cmd|powershell|wscript)' AND Arguments =~ '(?i)(base64|-enc)')
OR    Name =~ '^[A-Z0-9]{6,10}$'

# HUNT 3: Fleet-wide YARA memory scan for Qbot
SELECT * FROM foreach(
  row={SELECT * FROM clients()},
  query={SELECT * FROM yara(
    rules='''rule Qbot { strings: $s1="qbot" nocase condition: $s1 }''',
    pid='*')})

# LIVE RESPONSE: collect binary and remediate on FINANCE-WS-14
LET binary = upload(accessor='file', filename='C:/Windows/Temp/svchost64.dll')
SELECT * FROM binary
LET kill = execve(argv=['taskkill','/F','/PID','4521'])
SELECT * FROM kill

from cbapi.response import CbResponseAPI, Process
cb = CbResponseAPI(url='https://cbresponse.corp.local', token='CB_API_TOKEN', ssl_verify=True)

# HUNT 1: PowerShell encoded download cradles (last 30 days)
for proc in cb.select(Process).where(
    'process_name:powershell.exe AND cmdline:encodedcommand AND cmdline:downloadstring'):
    print(f'Host:{proc.hostname} | Time:{proc.start} | Parent:{proc.parent.process_name}')
    print(f'Cmd:{proc.cmdline[:200]}')

# HUNT 2: External network connections from PowerShell
for proc in cb.select(Process).where(
    'process_name:powershell.exe AND netconn_count:[1 TO *]'):
    for nc in proc.netconns:
        if not any(nc.remote_ip.startswith(p) for p in ('10.','172.16.','192.168.','127.')):
            print(f'Host:{proc.hostname} | C2:{nc.remote_ip}:{nc.remote_port}')

# HUNT 3: Office spawning shell processes (macro execution)
for parent in ['winword.exe','excel.exe','powerpnt.exe']:
    for child in ['powershell.exe','cmd.exe','wscript.exe','mshta.exe']:
        for proc in cb.select(Process).where(f'parent_name:{parent} AND process_name:{child}'):
            print(f'SUSPICIOUS: {proc.hostname} | {parent} -> {child}')
            print(f'  CmdLine: {proc.cmdline[:150]}')

# LIVE RESPONSE: collect binary and terminate process
sensor = cb.select('Sensor').where('hostname:DESKTOP-FINANCE-14').first()
with sensor.lr_session() as lr:
    lr.get_file(r'C:\Windows\Temp\svchost64.dll', '/cases/INC-2024-0847/svchost64.dll')
    lr.kill_process(4521)
    lr.delete_file(r'C:\Windows\Temp\svchost64.dll')

# Step 1: Authenticate to Cybereason
curl -s -c /tmp/cyb_cookies.txt -X POST \
  'https://cybereason.corp.local:8443/login.html' \
  -d 'username=admin&password=CybAdminPass2024!'

# Step 2: Query all unresolved MalOps
curl -s -b /tmp/cyb_cookies.txt -X POST \
  'https://cybereason.corp.local:8443/rest/crimes/unified?crimeStatus=UNRESOLVED' \
  -H 'Content-Type: application/json' \
  -d '{"templateContext":"OVERVIEW","filters":[{"fieldName":"malopActivityTypes",
    "operator":"ContainsAnyOf","values":["MALICIOUS_INFECTION","RANSOMWARE","LATERAL_MOVEMENT"]}]}'

# Step 3: Network-isolate ALL machines in the MalOp
curl -s -b /tmp/cyb_cookies.txt -X POST \
  'https://cybereason.corp.local:8443/rest/sensors/action' \
  -H 'Content-Type: application/json' \
  -d '{"action":"ISOLATE","filters":[{"fieldName":"malopGuid",
    "operator":"ContainsAnyOf","values":["MALOP_GUID"]}]}'

# Step 4: Kill processes and remove persistence
curl -s -b /tmp/cyb_cookies.txt -X POST \
  'https://cybereason.corp.local:8443/rest/remediate' \
  -H 'Content-Type: application/json' \
  -d '{"malopId":"MALOP_GUID","remediationItems":[
    {"actionType":"KILL_PROCESS","elementType":"PROCESS","elementValues":["PROC_ID_1","PROC_ID_2"]},
    {"actionType":"DELETE_REGISTRY_KEY","elementType":"REGISTRY_KEY","elementValues":["REG_KEY_GUID_1"]}
  ]}'

# Step 1: Authenticate
curl -s -c /tmp/res_cookies.txt -X POST 'https://resilient.corp.local/rest/session' \
  -H 'Content-Type: application/json' \
  -d '{"email":"admin@corp.com","password":"ResilientAdmin2024!"}'

# Step 2: Create ransomware incident with jurisdictional context
INC_ID=$(curl -s -b /tmp/res_cookies.txt \
  -X POST 'https://resilient.corp.local/rest/orgs/201/incidents' \
  -H 'Authorization: HMAC-RESAUTH' -H 'Content-Type: application/json' \
  -d '{"name":"BlackCat Ransomware — Finance Servers Jun2024",
    "incident_type_ids":[17],"severity_code":{"name":"High"},
    "properties":{"affected_countries":["US","UK","DE"],
      "data_compromised":true,"pii_involved":true,"pci_data_involved":true,
      "employee_count":847,"regulatory_exposure":["GDPR","CCPA","PCI_DSS_4"]}}' \
  | python3 -c "import sys,json;print(json.load(sys.stdin)['id'])")
echo "Created incident: INC-$INC_ID"

# Playbook Ransomware_Response_v4 auto-executes:
# Step A (auto): Recorded Future — enrich C2 IPs
# Step B (auto): CrowdStrike — isolate affected endpoints
# Step C (auto): Palo Alto — block C2 IPs at perimeter
# Step D (auto): PagerDuty — page on-call IR lead
# Step E (auto): Slack — notify CISO and #sec-incidents
# Step F (auto): ServiceNow — create P1 ticket
# Step G (MANUAL): IR lead confirms ransom decision
# Step H (auto): Calculate GDPR 72-hr notification clock
# Step I (auto): Calculate PCI DSS forensic investigation timeline
# Step J (auto): Generate breach notification letters (ICO, BfDI)
# Step K (MANUAL): Legal approves draft notifications
# Step L (auto): Preserve forensic evidence to immutable storage
# Step M (auto): Generate complete post-incident report

TOKEN=$(curl -s -X POST 'https://triage.corp.local/api/oauth/token' \
  -d 'grant_type=client_credentials&client_id=TRIAGE_ID&client_secret=TRIAGE_SECRET' \
  | python3 -c "import sys,json;print(json.load(sys.stdin)['access_token'])")

# Get all unprocessed phishing reports
curl -s 'https://triage.corp.local/api/public/v2/reports?filter[report_type]=phishing&filter[match_priority]=0&page[size]=100' \
  -H "Authorization: Bearer $TOKEN"

# Get all clusters from today
TODAY=$(date -u +%Y-%m-%dT00:00:00Z)
curl -s "https://triage.corp.local/api/public/v2/clusters?filter[created_at_gteq]=$TODAY" \
  -H "Authorization: Bearer $TOKEN" \
  | python3 -c "
import sys, json
clusters = json.load(sys.stdin)['data']
print(f'Clusters today: {len(clusters)}')
for c in clusters:
    a = c['attributes']
    print(f'  ID:{c["id"]} | Priority:{a["match_priority"]} | Reports:{a["report_count"]}')"

# Mark cluster malicious — triggers quarantine + IoC extraction
curl -s -X PATCH 'https://triage.corp.local/api/public/v2/clusters/CLUSTER_ID' \
  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{"data":{"type":"clusters","id":"CLUSTER_ID","attributes":{"match_priority":1}}}'

# Vision: find and quarantine ALL similar emails organisation-wide
curl -s -X POST 'https://triage.corp.local/api/public/v2/searches' \
  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{"data":{"type":"searches","attributes":{"cluster_id":"CLUSTER_ID","auto_quarantine":true}}}'

TOKEN=$(curl -s -X POST 'https://d3soar.corp.local/api/login' \
  -H 'Content-Type: application/json' \
  -d '{"username":"soar_admin","password":"D3SmartSOAR2024!"}' \
  | python3 -c "import sys,json;print(json.load(sys.stdin)['token'])")

INC=$(curl -s -X POST 'https://d3soar.corp.local/api/incidents' \
  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{"name":"BlackCat Ransomware — Finance Dept Jun2024","severity":"Critical",
    "category":"Ransomware","source":"CrowdStrike Falcon EDR",
    "assets":["FINANCE-SRV-01","FINANCE-SRV-02"],
    "playbook":"Ransomware_Response_Financial_v4",
    "context":{"pii_involved":true,"pci_involved":true,"jurisdictions":["US","UK","EU"]}}')

# Automated playbook: Ransomware_Response_Financial_v4
# STEP 01 (auto): Recorded Future — enrich C2 IPs/hashes
# STEP 02 (auto): CrowdStrike — isolate affected endpoints
# STEP 03 (auto): Palo Alto NGFW — block all C2 IPs/domains
# STEP 04 (auto): Active Directory — disable affected accounts
# STEP 05 (auto): PagerDuty — page IR lead
# STEP 06 (auto): Slack — notify CISO and exec channel
# STEP 07 (auto): ServiceNow — create P1 ticket
# STEP 08 (MANUAL): IR lead confirms ransom decision
# STEP 09 (auto): Calculate GDPR + PCI notification obligations
# STEP 10 (auto): Draft regulatory letters (ICO, BfDI, SEC 8-K)
# STEP 11 (auto): Generate cyber-insurance claim documentation
# STEP 12 (MANUAL): Legal approves notifications
# STEP 13 (auto): Preserve forensic evidence (immutable S3)
# STEP 14 (auto): Generate post-incident report

# Terraform: Enable Shield Advanced protection
resource "aws_shield_protection" "game_alb" {
  name         = "GameServer_ApplicationLB"
  resource_arn = aws_lb.game_lb.arn
}
resource "aws_shield_protection" "game_cloudfront" {
  name         = "GameServer_CloudFront"
  resource_arn = aws_cloudfront_distribution.game_cdn.arn
}

# CloudWatch alarm for DDoS detection
resource "aws_cloudwatch_metric_alarm" "shield_ddos" {
  alarm_name          = "Shield_DDoS_Detected"
  metric_name         = "DDoSDetected"
  namespace           = "AWS/DDoSProtection"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = 1
  period              = 60
  statistic           = "Sum"
  threshold           = 0
  alarm_actions       = ["arn:aws:sns:us-east-1:123456789:SecurityAlerts"]
  dimensions = { ResourceArn = aws_lb.game_lb.arn }
}

# CLI: Query active DDoS attacks
aws shield describe-attacks \
  --start-time 2024-06-17T00:00:00Z \
  --end-time 2024-06-17T23:59:59Z \
  | python3 -c "
import sys, json
d = json.load(sys.stdin)
for a in d.get('Attacks', []):
    print(f'Attack: {a["AttackId"]}')
    vecs = [v["VectorType"] for v in a.get('AttackVectors',[])]
    print(f'Vectors: {vecs}')"

# SRT-deployed rate-based WAF rule (during active HTTP flood)
aws wafv2 create-rule-group \
  --name SRT_Emergency_RateLimit --scope CLOUDFRONT --capacity 100 \
  --rules '[{"Name":"RateLimit_GameAPI","Priority":0,"Action":{"Block":{}},
    "Statement":{"RateBasedStatement":{"Limit":2000,"AggregateKeyType":"IP"}},
    "VisibilityConfig":{"SampledRequestsEnabled":true,
      "CloudWatchMetricsEnabled":true,"MetricName":"RateLimit_GameAPI"}}]' \
  --visibility-config SampledRequestsEnabled=true,CloudWatchMetricsEnabled=true,MetricName=SRT

# Enable Defender plans
az security pricing create --name VirtualMachines --tier Standard
az security pricing create --name Containers --tier Standard

# Query current Secure Score
az security secure-score show --name ascScore \
  --query '{Score:current.percentage,Max:max.percentage}' -o table
# Score: 42.3  |  Max: 100.0

# List all CRITICAL and HIGH recommendations
az security task list \
  --query '[?contains(resourceState,`Active`)].{Title:name,Resource:resourceDetails.resourceName}' \
  -o table | head -20

# Enable Just-in-Time VM Access on web servers
az security jit-policy update \
  --name default --resource-group production-rg --vm-name web-server-prod-01 \
  --ports '[{"number":22,"protocol":"TCP",
    "allowedSourceAddressPrefixes":["10.0.0.0/8"],
    "maxRequestAccessDuration":"PT4H"}]'

# Request JIT access — opens SSH for 2 hours from analyst IP
az security jit-policy initiate \
  --name default --resource-group production-rg --vm-name web-server-prod-01 \
  --vm-requests '[{"virtualMachineId":"/subscriptions/SUB/web-server-prod-01",
    "ports":[{"number":22,"duration":"PT2H","allowedSourceAddressPrefix":"203.0.113.10"}]}]'

# Query Defender security alerts via REST API
curl -s 'https://management.azure.com/subscriptions/SUB_ID/providers/Microsoft.Security/alerts?api-version=2022-01-01' \
  -H "Authorization: Bearer $(az account get-access-token --query accessToken -o tsv)" \
  | python3 -c "
import sys, json
alerts = json.load(sys.stdin)['value']
high = [a for a in alerts if a['properties']['severity']=='High']
print(f'High severity alerts: {len(high)}')" 

# Enable SCC
gcloud services enable securitycenter.googleapis.com --project=PROJECT_ID

# List CRITICAL and HIGH active findings
gcloud scc findings list --organization=ORG_ID \
  --filter='severity="CRITICAL" OR severity="HIGH" AND state="ACTIVE"' \
  --format='table(finding.name,finding.category,finding.severity,finding.createTime)'

# List public Cloud Storage buckets
gcloud scc findings list --organization=ORG_ID \
  --filter='finding.category="PUBLIC_BUCKET_ACL" AND finding.state="ACTIVE"'

# Set up Pub/Sub notification for CRITICAL findings
gcloud scc notifications create critical-findings-alert \
  --organization=ORG_ID \
  --pubsub-topic=projects/PROJECT_ID/topics/scc-critical-findings \
  --filter='severity = CRITICAL'

# Cloud Function: auto-isolate compromised GKE pod (triggered by Pub/Sub)
def isolate_pod(event, context):
    import base64, json
    finding = json.loads(base64.b64decode(event['data']).decode())
    if finding.get('finding',{}).get('category') == 'REVERSE_SHELL':
        resource  = finding['finding']['resourceName']
        pod_name  = extract_pod_name(resource)
        namespace = extract_namespace(resource)
        # Apply deny-all NetworkPolicy via kubernetes Python client
        network_policy = {
            'apiVersion': 'networking.k8s.io/v1', 'kind': 'NetworkPolicy',
            'metadata': {'name': f'isolate-{pod_name}', 'namespace': namespace},
            'spec': {'podSelector': {'matchLabels': {'app': pod_name}},
                     'policyTypes': ['Ingress','Egress']}
        }
        print(f'NetworkPolicy applied — pod {pod_name} isolated')

# Mark finding resolved via API
curl -s -X POST 'https://securitycenter.googleapis.com/v1/FINDING_NAME:setState' \
  -H "Authorization: Bearer $(gcloud auth print-access-token)" \
  -H 'Content-Type: application/json' \
  -d '{"state":"INACTIVE","startTime":"2024-06-17T12:00:00Z"}'

CF_ZONE="YOUR_ZONE_ID"
CF_TOKEN="YOUR_API_TOKEN"
CF_ACCOUNT="YOUR_ACCOUNT_ID"

# Block credential stuffing on /api/v1/login
curl -s -X POST "https://api.cloudflare.com/client/v4/zones/$CF_ZONE/firewall/rules" \
  -H "Authorization: Bearer $CF_TOKEN" -H 'Content-Type: application/json' \
  -d '[{"filter":{"expression":"(http.request.uri.path eq \"/api/v1/login\")
    and (http.request.method eq \"POST\")
    and (not cf.bot_management.verified_bot)
    and (rate_requests_minute gt 20)"},
    "action":"challenge",
    "description":"Rate-limit login — block credential stuffing"}]'

# Emergency WAF rule: block CVE-2024-23917 Confluence RCE
curl -s -X POST "https://api.cloudflare.com/client/v4/zones/$CF_ZONE/rulesets/RULESET_ID/rules" \
  -H "Authorization: Bearer $CF_TOKEN" -H 'Content-Type: application/json' \
  -d '{"action":"block",
       "expression":"(http.request.uri.path contains \"/setup/setupadministrator.action\"
         or http.request.uri.path contains \"/server-info.action\")
         and cf.threat_score gt 5",
       "description":"Block CVE-2024-23917 Confluence exploitation"}'

# Zero Trust: create Cloudflare Access app for internal HR portal
curl -s -X POST "https://api.cloudflare.com/client/v4/accounts/$CF_ACCOUNT/access/apps" \
  -H "Authorization: Bearer $CF_TOKEN" -H 'Content-Type: application/json' \
  -d '{"name":"Corporate HR Portal","domain":"hr.corp.internal.example.com",
       "type":"self_hosted","session_duration":"8h",
       "allowed_idps":["OKTA_IDP_ID"],"auto_redirect_to_identity":true}'

# Access Policy: require Okta SSO + managed device posture
curl -s -X POST "https://api.cloudflare.com/client/v4/accounts/$CF_ACCOUNT/access/apps/APP_ID/policies" \
  -H "Authorization: Bearer $CF_TOKEN" -H 'Content-Type: application/json' \
  -d '{"name":"Corp Employees — Managed Device","decision":"allow",
       "include":[{"email_domain":{"domain":"corp.com"}}],
       "require":[{"device_posture":{"integration_uid":"POSTURE_ID"}}]}'

# ZIA Authentication
curl -s -c /tmp/zia_cookies.txt -X POST 'https://zsapi.zscaler.net/api/v1/authenticatedSession' \
  -H 'Content-Type: application/json' \
  -d '{"username":"admin@corp.zscaler.net","password":"ZscalerAdmin2024!","apiKey":"ZIA_API_KEY"}'

# ZIA: Create URL filtering rule — block crypto mining sites
curl -s -b /tmp/zia_cookies.txt -X POST 'https://zsapi.zscaler.net/api/v1/urlFilteringRules' \
  -H 'Content-Type: application/json' \
  -d '{"name":"Block_Crypto_Mining","order":1,
       "protocols":["HTTPS_RULE","HTTP_RULE"],
       "urlCategories":["CRYPTO_CURRENCY"],"state":"ENABLED","action":"BLOCK"}'

# ZIA: Enable SSL inspection for all categories
curl -s -b /tmp/zia_cookies.txt -X PUT 'https://zsapi.zscaler.net/api/v1/sslSettings' \
  -H 'Content-Type: application/json' \
  -d '{"enableSSLScan":true,"defaultAction":"DECRYPT"}'

# ZPA: Create application segment for SAP ERP (replaces VPN rule)
curl -s -X POST 'https://config.private.zscaler.com/api/v1/application' \
  -H 'Authorization: Bearer ZPA_API_TOKEN' -H 'Content-Type: application/json' \
  -d '{"name":"Corporate_SAP_ERP","domainNames":["sap-prod.corp.internal"],
       "tcpPortRanges":[{"from":"443","to":"443"}],
       "segmentGroupId":"SEG_GROUP_ID","serverGroups":[{"id":"SERVER_GROUP_ID"}]}'

# ZPA: Access policy — require Okta SSO + managed device
curl -s -X POST 'https://config.private.zscaler.com/api/v1/policySet/POLICY_SET_ID/rule' \
  -H 'Authorization: Bearer ZPA_API_TOKEN' -H 'Content-Type: application/json' \
  -d '{"name":"SAP_FinanceTeam_ManagedDevice","action":"ALLOW",
       "conditions":[
         {"operands":[{"objectType":"SCIM_GROUP","values":["Finance_Team"]}]},
         {"operands":[{"objectType":"POSTURE","values":["MANAGED_DEVICE_ID"]}]}
       ]}'

TOKEN=$(curl -s -X POST 'https://api.prismacloud.io/login' \
  -H 'Content-Type: application/json' \
  -d '{"username":"admin@corp.com","password":"PrismaAdmin2024!","customerName":"CorpInc"}' \
  | python3 -c "import sys,json;print(json.load(sys.stdin)['token'])")

# Query all CRITICAL open alerts
curl -s -X POST 'https://api.prismacloud.io/alert' \
  -H "x-redlock-auth: $TOKEN" -H 'Content-Type: application/json' \
  -d '{"filters":[
    {"name":"alert.status","operator":"=","value":"open"},
    {"name":"policy.severity","operator":"=","value":"critical"}],
    "limit":50,"timeRange":{"type":"to_now","value":"epoch"}}' \
  | python3 -c "
import sys, json
alerts = json.load(sys.stdin)['items']
print(f'Critical open alerts: {len(alerts)}')
for a in alerts[:5]:
    print(f'  {a["policy"]["name"]} — {a["resource"]["name"]}')"

# Get PCI DSS compliance posture
curl -s -X POST 'https://api.prismacloud.io/compliance/posture' \
  -H "x-redlock-auth: $TOKEN" -H 'Content-Type: application/json' \
  -d '{"filters":[{"name":"policy.complianceStandard","operator":"=","value":"PCI DSS v3.2.1"}],
       "timeRange":{"type":"to_now","value":"epoch"}}'

# Automated Lambda remediation for public S3 bucket
import boto3
def remediate_public_s3(event, context):
    s3 = boto3.client('s3')
    bucket = event['resource']['name']
    s3.put_public_access_block(Bucket=bucket, PublicAccessBlockConfiguration={
        'BlockPublicAcls':True,'IgnorePublicAcls':True,
        'BlockPublicPolicy':True,'RestrictPublicBuckets':True})
    print(f'Public access blocked on s3://{bucket}')

TOKEN=$(curl -s -X POST 'https://api.dome9.com/v2/access-token' \
  -u 'API_KEY_ID:API_KEY_SECRET' \
  | python3 -c "import sys,json;print(json.load(sys.stdin)['token'])")

# Run PCI DSS assessment
ASSESS_ID=$(curl -s -X POST 'https://api.dome9.com/v2/assessment/bundleV2' \
  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{"id":16,"cloudAccountIds":["AWS_ACCOUNT_ID"],"cloudAccountType":"aws"}' \
  | python3 -c "import sys,json;print(json.load(sys.stdin)['id'])")

sleep 60
curl -s "https://api.dome9.com/v2/assessment/$ASSESS_ID" -H "Authorization: Bearer $TOKEN" \
  | python3 -c "
import sys, json
r = json.load(sys.stdin)
print(f'Tests passed: {r.get("passedCount")}')
print(f'Tests failed: {r.get("failedCount")}')
print(f'Score: {r.get("score")}%')"

# GSL custom rule — detect unrestricted SSH (0.0.0.0/0 on port 22)
curl -s -X POST 'https://api.dome9.com/v2/Compliance/Ruleset' \
  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{"name":"PCI_No_Unrestricted_SSH","cloudVendor":"aws",
    "rules":[{"name":"Block public SSH access","severity":"Critical",
      "logic":"SecurityGroup should not have inboundRules with [port=22 and source=\"0.0.0.0/0\"]",
      "remediationSteps":"Remove 0.0.0.0/0 from SSH ingress rule."}]}'

# Enable CloudBot auto-remediation
# Dome9 > Settings > CloudBots > Enable: sg-delete-rule
# Trigger: Policy violation 'Block public SSH access'

# Generate PDF compliance report
curl -s -X POST 'https://api.dome9.com/v2/assessment/export/pdf' \
  -H "Authorization: Bearer $TOKEN" \
  -d "{\"assessmentId\":\"$ASSESS_ID\"}" \
  -o 'PCI_DSS_Assessment_Q2_2024.pdf'

# Query personal Dropbox upload events (last 90 days)
curl -s 'https://corp.goskope.com/api/v1/events/data?token=API_TOKEN&type=application
  &query=app eq "Dropbox" and activity eq "Upload" and from_user not like "%corp.com"
  &starttime=1704067200' \
  | python3 -c "
import sys, json
events = json.load(sys.stdin).get('data',[])
print(f'Personal Dropbox uploads: {len(events)}')
print(f'Unique uploading users: {len(set(e.get("user") for e in events))}')"

# Get Cloud Confidence Index for personal Dropbox
curl -s 'https://corp.goskope.com/api/v1/app/cci?token=API_TOKEN&appName=Dropbox+Personal' \
  | python3 -c "
import sys, json
d = json.load(sys.stdin).get('data',{})
print(f'CCI Score: {d.get("cci_score")}/100 | Risk: {d.get("risk_level")}')"

# DLP Policy: block M&A content upload to personal cloud storage
# Netskope GUI: Policies > Real-time Protection > New Policy
# Type: Cloud Storage | Activity: Upload
# Destination: All Personal Cloud Storage (CCI < 70)
# DLP Profile: MA_Confidential (patterns: 'non-public','transaction value','deal team')
# Action: Block + Notify user + Alert SOC

# Query DLP incidents
curl -s 'https://corp.goskope.com/api/v1/alerts?token=API_TOKEN&type=DLP' \
  | python3 -c "
import sys, json
alerts = json.load(sys.stdin).get('data',[])
print(f'DLP violations: {len(alerts)}')
for a in alerts[:5]:
    print(f'  User:{a.get("user")} File:{a.get("object")}')" 

TOKEN=$(curl -s -X POST 'https://cloudone.trendmicro.com/api/authenticate' \
  -H 'Content-Type: application/json' \
  -d '{"userid":"admin@corp.com","secret":"CloudOneSecret2024!"}' \
  | python3 -c "import sys,json;print(json.load(sys.stdin)['AuthenticationResult']['Token'])")

# Container Security: scan an ECR image for vulnerabilities
SCAN_ID=$(curl -s -X POST 'https://cloudone.trendmicro.com/api/container/images/scan' \
  -H "Authorization: ApiKey $TOKEN" -H 'Content-Type: application/json' \
  -d '{"name":"myapp","tag":"v2.3.0","registry":"123456789.dkr.ecr.us-east-1.amazonaws.com"}' \
  | python3 -c "import sys,json;print(json.load(sys.stdin)['id'])")

sleep 120
curl -s "https://cloudone.trendmicro.com/api/container/images/$SCAN_ID/vulnerabilities" \
  -H "Authorization: ApiKey $TOKEN" \
  | python3 -c "
import sys, json
vulns = json.load(sys.stdin)['vulnerabilities']
critical = [v for v in vulns if v.get('severity')=='critical']
print(f'Total: {len(vulns)} | Critical: {len(critical)}')
for v in critical[:5]:
    print(f'  {v["cve_id"]}: {v["package_name"]} {v["version"]}')"

# Conformity: get CRITICAL failed checks
curl -s 'https://cloudone.trendmicro.com/api/conformity/checks?filter[status]=FAILURE&filter[riskLevel]=CRITICAL' \
  -H "Authorization: ApiKey $TOKEN" \
  | python3 -c "
import sys, json
checks = json.load(sys.stdin)['data']
print(f'Critical failures: {len(checks)}')
for c in checks[:5]:
    print(f'  {c["attributes"]["rule"]["title"]} — {c["attributes"]["resource"]["name"]}')"

# Workload Security: apply IPS virtual patch for CVE-2024-21762
curl -s -X POST 'https://cloudone.trendmicro.com/api/policies/POLICY_ID/intrusion-prevention/rules' \
  -H "Authorization: ApiKey $TOKEN" -H 'Content-Type: application/json' \
  -d '{"ruleIDs": [49125]}'  # IPS rule ID for CVE-2024-21762

TOKEN=$(curl -s -X POST 'https://mvisioncloudasc.mcafee.com/api/v1/user/login' \
  -H 'Content-Type: application/json' \
  -d '{"username":"admin@corp.com","password":"MVisionAdmin2024!"}' \
  | python3 -c "import sys,json;print(json.load(sys.stdin)['token'])")

# Shadow IT discovery — top high-risk unsanctioned apps
curl -s 'https://mvisioncloudasc.mcafee.com/api/v1/cloud-services/shadow-it' \
  -H "Authorization: Bearer $TOKEN" \
  | python3 -c "
import sys, json
apps = json.load(sys.stdin).get('services',[])
high = sorted([a for a in apps if a.get('riskScore',0)>=7], key=lambda x:x['riskScore'],reverse=True)
print(f'Unsanctioned apps: {len(apps)} | High-risk (7-10): {len(high)}')
for a in high[:5]:
    print(f'  {a["name"]}: {a["riskScore"]}/10 | Users:{a.get("userCount",0)}')"

# DLP violations — PHI shared externally in M365
curl -s 'https://mvisioncloudasc.mcafee.com/api/v1/dlp/violations?service=Office365&classification=PHI&sharing=external' \
  -H "Authorization: Bearer $TOKEN" \
  | python3 -c "
import sys, json
v = json.load(sys.stdin).get('violations',[])
print(f'PHI files shared externally: {len(v)}')
public = [x for x in v if x.get('sharing')=='PUBLIC_LINK']
print(f'  Via public links: {len(public)}')"

# Auto-quarantine policy: remove public sharing from PHI files
curl -s -X POST 'https://mvisioncloudasc.mcafee.com/api/v1/dlp/policies' \
  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{"name":"HIPAA_Block_PHI_External","classification":"PHI",
       "action":"QUARANTINE","condition":"SHARED_EXTERNALLY",
       "services":["Office365","Google_Workspace"],
       "notify_user":true,"notify_admin":true}'

# Note: Paros is deprecated (last release 2006).
# Use OWASP ZAP or Burp Suite for production security testing.
# This demonstration is for educational and historical understanding only.

# Step 1: Configure browser proxy settings
# Firefox: Settings > Network > Manual Proxy Configuration
#   HTTP Proxy:  127.0.0.1  Port: 8080
#   HTTPS Proxy: 127.0.0.1  Port: 8080

# Step 2: Launch Paros (Java application)
java -jar paros.jar &
# GUI opens — listening on localhost:8080

# Step 3: Install Paros CA certificate in browser
# Tools > Root CA > Export Certificate
# Firefox: Settings > Certificates > Import paros_ca.cer

# Step 4: Intercept a login request
# Paros > Trap > Trap Request
# Navigate to login page — Paros intercepts the POST request:
# POST /login HTTP/1.1
# username=admin&password=password123

# Step 5: SQL injection test via request editor
# Edit intercepted parameter:
# username=admin'--&password=anything
# Click Continue — observe if login succeeds (auth bypass)

# Step 6: Run Paros scanner
# Analyse > Spider  (discovers all pages and forms)
# Analyse > Active Scan  (tests SQLi, XSS, path traversal)

# Step 7: Compare with OWASP ZAP (modern equivalent)
./zap.sh -quickurl http://vulnerable-app.local -quickout report.html
# ZAP: 42 vulnerabilities found (vs Paros: 8 detections)
# ZAP additionally finds: DOM XSS, SSRF, IDOR, modern auth flaws

TOKEN=$(curl -s -X POST 'https://api.webtitan.com/api/v2/auth/token' \
  -H 'Content-Type: application/json' \
  -d '{"username":"admin@msp.com","password":"WebTitanMSP2024!"}' \
  | python3 -c "import sys,json;print(json.load(sys.stdin)['token'])")

# List all managed client networks
curl -s 'https://api.webtitan.com/api/v2/networks' -H "Authorization: Bearer $TOKEN" \
  | python3 -c "import sys,json;print(f'Managed networks: {len(json.load(sys.stdin)["networks"])}')"

# Add Log4Shell callback domains to global blocklist (all clients)
curl -s -X POST 'https://api.webtitan.com/api/v2/lists/blacklist/domains' \
  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{"domains":["log4j-test.dnslog.cn","ldap.rce.cyou","interactsh.com"],
       "reason":"Log4Shell CVE-2021-44228 callback domains",
       "apply_to_all_networks":true}'

# Query blocked events for a specific client
curl -s 'https://api.webtitan.com/api/v2/reporting/dns-queries?network_id=CLIENT_NETWORK_ID&action=BLOCKED&category=Malware&start_date=2024-06-01T00:00:00Z' \
  -H "Authorization: Bearer $TOKEN" \
  | python3 -c "
import sys, json
e = json.load(sys.stdin)['events']
print(f'Blocked malware DNS queries: {len(e)}')
domains = set(x.get('domain') for x in e)
print(f'Unique blocked domains: {len(domains)}')
for d in list(domains)[:10]:
    print(f'  Blocked: {d}')"

# Create per-client custom policy for high-risk client
curl -s -X PUT 'https://api.webtitan.com/api/v2/policies/POLICY_ID' \
  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{"blocked_categories":["Malware","Phishing","Botnet","Proxy_Avoidance","Newly_Registered_Domains"],
       "safe_search_enforced":true}'

TOKEN=$(curl -s -X POST 'https://api.sitelock.com/v1/auth/token' \
  -H 'Content-Type: application/json' \
  -d '{"username":"admin@store.com","password":"SiteLockAdmin2024!"}' \
  | python3 -c "import sys,json;print(json.load(sys.stdin)['access_token'])")

# Get current security status for all monitored sites
curl -s 'https://api.sitelock.com/v1/sites' -H "Authorization: Bearer $TOKEN" \
  | python3 -c "
import sys, json
for s in json.load(sys.stdin)['sites']:
    print(f'Domain: {s["domain"]} | Status: {s["security_status"]} | Malware: {s.get("malware_detected",False)}')"

# Trigger immediate high-priority malware scan
curl -s -X POST 'https://api.sitelock.com/v1/sites/SITE_ID/scans' \
  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{"scan_type":"malware","priority":"high"}'

# Get scan results with malware findings
curl -s 'https://api.sitelock.com/v1/sites/SITE_ID/findings?type=malware&status=active' \
  -H "Authorization: Bearer $TOKEN" \
  | python3 -c "
import sys, json
findings = json.load(sys.stdin)['findings']
print(f'Active malware findings: {len(findings)}')
for f in findings:
    print(f'  {f["file_path"]}: {f["malware_type"]} | Auto-removed: {f.get("auto_removed",False)}')"

# Request SMART automated malware removal
curl -s -X POST 'https://api.sitelock.com/v1/sites/SITE_ID/remediation/smart' \
  -H "Authorization: Bearer $TOKEN" -d '{"auto_remove":true}'

# Get CMS vulnerability report (WordPress)
curl -s 'https://api.sitelock.com/v1/sites/SITE_ID/vulnerabilities?cms=wordpress' \
  -H "Authorization: Bearer $TOKEN" \
  | python3 -c "
import sys, json
vulns = json.load(sys.stdin)['vulnerabilities']
print(f'CMS vulnerabilities: {len(vulns)}')
for v in vulns:
    print(f'  {v.get("component")}: {v.get("cve_id")} CVSS:{v.get("cvss")}')" 

# Maltego Python Transform — custom Bitcoin OSINT
from maltego_trx.transform import DiscoverableTransform
import requests

class BitcoinWalletTransactions(DiscoverableTransform):
    @classmethod
    def create_entities(cls, request, response):
        btc_address = request.Value
        data = requests.get(f'https://blockchain.info/rawaddr/{btc_address}', timeout=10).json()
        for tx in data.get('txs', [])[:10]:
            for output in tx.get('out', []):
                addr = output.get('addr', '')
                if addr and addr != btc_address:
                    entity = response.addEntity('maltego.BitcoinAddress', addr)
                    entity.addProperty('Amount BTC', value=str(output.get('value',0)/1e8))

# Maltego GUI investigation workflow:

# STEP 1: Start with ransom note Bitcoin wallet
# New Graph > Add Entity: BitcoinAddress
# Value: 1BvBMSEYstWetqTFn5Au4m4GFg7xJaNVN2

# STEP 2: Bitcoin Transforms
# Right-click > Run Transform: Wallet to Transactions
# Graph expands to transaction partners

# STEP 3: Pivot to Tor .onion negotiation URL
# Add Entity: URL (from ransom note)
# Run Transforms: URL > Domain > IP > Shodan open ports

# STEP 4: Certificate transparency analysis
# Run Transform: Domain to SSL Certificates (crt.sh)
# Shared cert fingerprint reveals other domains

# STEP 5: WHOIS pivoting on all discovered domains
# Run Transform: Domain to WHOIS
# Filter: shared registrar email across domains

# STEP 6: Breach record lookup
# Run Transform: Email to HaveIBeenPwned

TOKEN=$(curl -s -X POST 'https://bluvector.corp.local:8443/api/v1/auth/login' \
  -H 'Content-Type: application/json' \
  -d '{"username":"admin","password":"BluVectorAdmin2024!"}' \
  | python3 -c "import sys,json;print(json.load(sys.stdin)['token'])")

# Query high-confidence malicious detections (last 24h)
curl -s 'https://bluvector.corp.local:8443/api/v1/detections?severity=HIGH,CRITICAL&confidence_min=0.85&start_time=2024-06-16T00:00:00Z' \
  -H "Authorization: Bearer $TOKEN" \
  | python3 -c "
import sys, json
dets = json.load(sys.stdin)['detections']
print(f'High-confidence detections: {len(dets)}')
for d in dets[:5]:
    print(f'  File:{d["filename"]} | SHA256:{d["sha256"]} | ML Score:{d["confidence"]:.2%}')
    print(f'    Source: {d["src_ip"]} -> {d["dst_ip"]}')"

# Get detailed detection report
curl -s 'https://bluvector.corp.local:8443/api/v1/detections/DETECTION_ID' \
  -H "Authorization: Bearer $TOKEN" \
  | python3 -c "
import sys, json
d = json.load(sys.stdin)
print(f'Classification: {d["classification"]}')
print(f'ML Confidence:  {d["confidence"]:.2%}')
print(f'Similar Family: {d["closest_family"]}')"

# Download reconstructed file for sandbox analysis
curl -s 'https://bluvector.corp.local:8443/api/v1/detections/DETECTION_ID/file' \
  -H "Authorization: Bearer $TOKEN" \
  -o '/cases/INC-2024-0847/bluvector_sample.pdf'

# Retroactive analysis — re-scan last 30 days with updated models
curl -s -X POST 'https://bluvector.corp.local:8443/api/v1/retroactive-scan' \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"pcap_start_date":"2024-05-17","pcap_end_date":"2024-06-17","model_version":"latest"}'

# Magnet AUTOMATE: trigger collection on SIEM P1 BEC alert
from flask import Flask, request
import subprocess

app = Flask(__name__)

@app.route('/axiom-automate', methods=['POST'])
def trigger_collection():
    alert = request.json
    if alert.get('severity') == 'P1' and 'BEC' in alert.get('tags', []):
        subprocess.run(['MagnetAutomate', '--trigger', 'collect',
            '--case', alert['incident_id'],
            '--host', alert['affected_host'],
            '--user', alert['affected_user'],
            '--profile', 'BEC_Investigation_Profile',
            '--output', f'/cases/{alert["incident_id"]}/evidence/'])
    return {'status': 'collection_triggered'}, 200

# AXIOM Cyber GUI investigation workflow:

# STEP 1: Create case — File > New Case > BEC_CFO_Jun2024

# STEP 2: Acquire Microsoft 365 mailbox evidence
# Add Evidence > Cloud > Microsoft 365
#   Target:     cfo@corp.com
#   Evidence:   Email, Calendar, OneDrive, SharePoint, Teams Messages
#   Date range: All available (12 months)

# STEP 3: Remote endpoint collection (CFO laptop at 10.50.14.22)
# Add Evidence > Remote Computer > 10.50.14.22
#   Profile: IR_Standard
#     Windows Event Logs (Security, System, Sysmon)
#     Browser history (Chrome, Edge)
#     Prefetch, shimcache, amcache
#     Registry hives (NTUSER.DAT, SAM, SYSTEM)
#     Recent files (LNK, Jump Lists, Shellbags)

# STEP 4: Process with Magnet.AI
# Process > Process Evidence
# Enable: Magnet.AI Categorisation, Timeline, Connections

# STEP 5: Review unified timeline
# Timeline > 2024-05-01 to 2024-06-17
# Filter: User=cfo@corp.com | Sort: chronological

TOKEN=$(curl -s -X POST 'https://api.prelude.org/detect/authenticate' \
  -H 'Content-Type: application/json' \
  -d '{"account_id":"ACCT_ID","handle":"admin","password":"PreludeDetect2024!"}' \
  | python3 -c "import sys,json;print(json.load(sys.stdin)['token'])")

# List VSTs mapped to ransomware ATT&CK techniques
curl -s 'https://api.prelude.org/detect/tests' -H "Token: $TOKEN" \
  | python3 -c "
import sys, json
tests = json.load(sys.stdin)['tests']
ransomware_ttps = ['T1059.001','T1003.001','T1082','T1486','T1490']
relevant = [t for t in tests if t.get('technique_id') in ransomware_ttps]
print(f'Ransomware TTP tests available: {len(relevant)}')
for t in relevant:
    print(f'  {t["technique_id"]}: {t["name"]}')"

# Deploy VST to a Windows test endpoint
curl -s -X POST 'https://api.prelude.org/detect/queue' -H "Token: $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"test":"T1059.001_POWERSHELL_ENCODED","endpoint":"ENDPOINT_ID_WINDOWS_TESTHOST"}'

sleep 120

# Check results
curl -s 'https://api.prelude.org/detect/activity' -H "Token: $TOKEN" \
  | python3 -c "
import sys, json
for a in json.load(sys.stdin)['activity'][:10]:
    print(f'Test: {a["test"]} | Technique: {a["technique_id"]}')
    print(f'  Executed: {a["executed"]} | Detected: {a["detected"]}')
    if a.get('status') == 'GAP':
        print(f'  GAP: No detection — controls need remediation')"

# Get ATT&CK coverage visualisation
curl -s 'https://api.prelude.org/detect/coverage' -H "Token: $TOKEN" \
  | python3 -c "
import sys, json
c = json.load(sys.stdin)
print(f'Techniques tested:   {c["tested_techniques"]}')
print(f'Detected:            {c["detected_techniques"]}')
print(f'Coverage gaps:       {c["gap_count"]}')
print(f'Coverage %:          {c["coverage_percentage"]}%')" 

TOKEN=$(curl -s -X POST 'https://varonis.corp.local/api/v1/auth/token' \
  -H 'Content-Type: application/json' \
  -d '{"username":"varonis_api","password":"VaronisAPI2024!"}' \
  | python3 -c "import sys,json;print(json.load(sys.stdin)['access_token'])")

# Query all CRITICAL active alerts (last 24h)
curl -s 'https://varonis.corp.local/api/v1/alerts?severity=CRITICAL,HIGH&status=OPEN&start_time=2024-06-16T00:00:00Z' \
  -H "Authorization: Bearer $TOKEN" \
  | python3 -c "
import sys, json
alerts = json.load(sys.stdin)['alerts']
print(f'Critical/High alerts: {len(alerts)}')
for a in alerts[:5]:
    print(f'  {a["rule_name"]}: {a["affected_user"]}')"

# Get AD misconfiguration risk report
curl -s 'https://varonis.corp.local/api/v1/reports/ad-risk' \
  -H "Authorization: Bearer $TOKEN" \
  | python3 -c "
import sys, json
r = json.load(sys.stdin)
print('Active Directory Risk Summary:')
print(f'  Stale user accounts:      {r.get("stale_users",0)}')
print(f'  Non-expiring passwords:   {r.get("non_expiring_passwords",0)}')
print(f'  Unconstrained delegation: {r.get("unconstrained_delegation",0)}')
print(f'  Shadow admin paths:       {r.get("shadow_admin_paths",0)}')"

# Get Kerberoasting alert details (SPNs targeted)
curl -s 'https://varonis.corp.local/api/v1/alerts/ALERT_ID/events' \
  -H "Authorization: Bearer $TOKEN" \
  | python3 -c "
import sys, json
events = json.load(sys.stdin)['events']
spns = [e.get('target_spn') for e in events if e.get('event_type')=='TGS_REQUEST']
print(f'SPNs targeted: {len(spns)}')
for s in spns[:10]: print(f'  {s}')"

# Automated response: disable compromised account
curl -s -X POST 'https://varonis.corp.local/api/v1/alerts/ALERT_ID/actions' \
  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{"action":"DISABLE_USER","target_user":"helpdesk.user@corp.com",
       "reason":"Kerberoasting attack detected INC-2024-0847"}'

# Authenticate (OAuth2 client credentials)
AUTH=$(curl -s -X POST 'https://id.sophos.com/api/v2/oauth2/token' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=client_credentials&client_id=SOPHOS_CLIENT_ID&client_secret=SOPHOS_CLIENT_SECRET&scope=token')
ACCESS_TOKEN=$(echo $AUTH | python3 -c "import sys,json;print(json.load(sys.stdin)['access_token'])")
TENANT_ID="YOUR_TENANT_ID"

# Query critical endpoint alerts (last 24h)
curl -s 'https://api.central.sophos.com/endpoint/v1/alerts?severity=critical&from=2024-06-16T00:00:00.000Z' \
  -H "Authorization: Bearer $ACCESS_TOKEN" -H "X-Tenant-ID: $TENANT_ID" \
  | python3 -c "
import sys, json
alerts = json.load(sys.stdin).get('items',[])
print(f'Critical alerts (24h): {len(alerts)}')
for a in alerts[:5]:
    print(f'  [{a["type"]}] {a["description"]}')
    print(f'    Host: {a["managedAgent"]["hostname"]}')"

# Network-isolate a compromised endpoint
curl -s -X POST 'https://api.central.sophos.com/endpoint/v1/endpoints/ENDPOINT_ID/isolate' \
  -H "Authorization: Bearer $ACCESS_TOKEN" -H "X-Tenant-ID: $TENANT_ID" \
  -H 'Content-Type: application/json' \
  -d '{"comment":"LockBit detected — isolating for investigation"}'

# Query CryptoGuard rollback events
curl -s 'https://api.central.sophos.com/endpoint/v1/events?eventTypes=crypto_guard&from=2024-06-16T00:00:00.000Z' \
  -H "Authorization: Bearer $ACCESS_TOKEN" -H "X-Tenant-ID: $TENANT_ID" \
  | python3 -c "
import sys, json
events = json.load(sys.stdin).get('items',[])
print(f'CryptoGuard events: {len(events)}')
for e in events[:3]:
    print(f'  Host:{e["source"]["hostname"]} | Files rolled back:{e.get("filesRestored",0)} | Threat:{e["name"]}')"

# Sophos XDR: hunt for LockBit lateral movement in data lake
curl -s -X POST 'https://api.central.sophos.com/xdr-query/v1/queries/runs' \
  -H "Authorization: Bearer $ACCESS_TOKEN" -H "X-Tenant-ID: $TENANT_ID" \
  -H 'Content-Type: application/json' \
  -d '{"adHocQuery":{"template":"SELECT filePath,userName,spawnedProcessName,time
    FROM xdr_data.endpoint.process.start WHERE time > ago(1d)
    AND (spawnedProcessName LIKE \'%wmic%\' OR spawnedProcessName LIKE \'%psexec%\')
    ORDER BY time DESC LIMIT 100"},
    "from":"2024-06-16T00:00:00.000Z"}'