Moltbot Incident Response: Automatisierung & Playbooks

// moltbot/lib/auto-remediation.ts
import { Redis } from '@upstash/redis';

const redis = new Redis({ url: process.env.UPSTASH_REDIS_REST_URL!, token: process.env.UPSTASH_REDIS_REST_TOKEN! });

type IncidentType = 'brute_force' | 'injection_attempt' | 'data_exfiltration' | 'privilege_escalation';

const REMEDIATION_PLAYBOOKS: Record<IncidentType, (ip: string) => Promise<void>> = {
  brute_force: async (ip) => {
    await redis.setex(`block:${ip}`, 3600, '1');          // 1h Block
    await redis.setex(`rate_strict:${ip}`, 7200, '1');    // 2h Strict Rate Limit
  },
  injection_attempt: async (ip) => {
    await redis.setex(`block:${ip}`, 86400, '1');         // 24h Block
    await notifySlack('injection_attempt', ip, 'P2');
  },
  data_exfiltration: async (ip) => {
    await redis.setex(`block:${ip}`, -1, '1');            // Permanent Block
    await notifySlack('data_exfiltration', ip, 'P1');
    await notifyPagerDuty('data_exfiltration', ip);
  },
  privilege_escalation: async (ip) => {
    await redis.setex(`block:${ip}`, -1, '1');
    await notifyPagerDuty('privilege_escalation', ip);
    await triggerKubernetesIsolation(ip);
  },
};

export async function executePlaybook(type: IncidentType, ip: string) {
  const playbook = REMEDIATION_PLAYBOOKS[type];
  await playbook(ip);
  await redis.lpush('incident_log', JSON.stringify({ type, ip, ts: Date.now(), action: 'auto_remediated' }));
}