Skip to content

example-workflow.md

Latest commit

 

History

History
384 lines (288 loc) · 11.6 KB

example-workflow.md

File metadata and controls

384 lines (288 loc) · 11.6 KB

Example Workflow: Unified Security Investigation

This document provides example outputs for a typical security investigation using Claude with both Splunk MCP and DeepTempo MCP servers.

🎯 Investigation Scenario

Situation: A security analyst needs to investigate high-confidence security incidents and correlate them with threat intelligence.

Traditional Process (30-45 minutes):

  1. Log into Splunk
  2. Write SPL query for high-confidence incidents
  3. Review results and extract IP addresses
  4. Log into DeepTempo
  5. Manually search for each IP
  6. Copy/paste findings into a report
  7. Add analysis and recommendations
  8. Format and share

With Claude + MCP (3-5 minutes):

  1. Ask Claude one question
  2. Review the unified report

Step 1: Query Splunk for Incidents

User Query

Show me the highest confidence security incidents from Splunk in the last 24 hours. 
Focus on incidents with urgency="high" or severity="critical".

Claude's Response (Example)

I'll search Splunk for high-confidence security incidents. Let me query that for you.

Search Results from Splunk:

Time Source IP Destination IP Event Type Severity Urgency Description
2026-01-25 14:32:15 192.168.1.100 10.0.50.25 lateral_movement critical high Suspicious SMB access to multiple hosts
2026-01-25 13:45:22 10.0.10.55 8.8.8.8 c2_beaconing critical high Regular beaconing to external IP
2026-01-25 12:18:47 192.168.1.100 172.16.5.200 privilege_escalation high high Unauthorized elevation attempt
2026-01-25 11:55:33 10.0.10.55 185.220.101.42 data_exfiltration critical high Large data transfer to suspicious IP
2026-01-25 10:22:18 192.168.5.88 10.0.50.25 brute_force high high Multiple failed auth attempts

Summary:

  • Total Incidents: 5 high-confidence events
  • Unique Source IPs: 3 (192.168.1.100, 10.0.10.55, 192.168.5.88)
  • Most Active IP: 192.168.1.100 (2 incidents)
  • Severity Distribution: 4 critical, 1 high

Key Observations:

  1. IP 192.168.1.100 appears in multiple incidents (lateral movement + privilege escalation)
  2. IP 10.0.10.55 shows signs of compromise (C2 beaconing + data exfiltration)
  3. All incidents occurred within a 5-hour window, suggesting coordinated attack

Step 2: Correlate with DeepTempo

User Query

From those incidents, extract all the IP addresses and tell me what DeepTempo 
knows about them. Are there any existing findings or cases related to these IPs?

Claude's Response (Example)

I've extracted the following IP addresses from the Splunk incidents. Let me check DeepTempo for related findings and cases.

Extracted IPs:

  • Source IPs: 192.168.1.100, 10.0.10.55, 192.168.5.88
  • Destination IPs: 10.0.50.25, 8.8.8.8, 172.16.5.200, 185.220.101.42

DeepTempo Findings:

192.168.1.100 (Internal Workstation)

Finding ID: DT-2026-001423
Status: Active Investigation
Confidence: 95%
First Seen: 2026-01-24 09:15:00
Finding Summary:

  • Identified as compromised workstation in Finance department
  • Evidence of credential theft via Mimikatz
  • Related to Case #SOC-2026-042 "Finance Department Breach"

MITRE ATT&CK Techniques:

  • T1003.001 - OS Credential Dumping: LSASS Memory
  • T1021.002 - Remote Services: SMB/Windows Admin Shares
  • T1078 - Valid Accounts

Related Cases:

  • SOC-2026-042 (Active - assigned to Analyst Sarah Chen)

10.0.10.55 (Internal Server)

Finding ID: DT-2026-001456
Status: Confirmed Compromised
Confidence: 98%
First Seen: 2026-01-23 16:30:00
Finding Summary:

  • Web server showing signs of backdoor installation
  • C2 communications to known bad IP 185.220.101.42
  • Part of APT-28 infrastructure (GRU cyber operations)

MITRE ATT&CK Techniques:

  • T1071.001 - Application Layer Protocol: Web Protocols
  • T1041 - Exfiltration Over C2 Channel
  • T1059.001 - Command and Scripting Interpreter: PowerShell

Threat Intelligence:

  • External IP 185.220.101.42 flagged by multiple threat feeds
  • Associated with APT-28 (Fancy Bear) campaigns
  • Known for targeting financial and government sectors

Related Cases:

  • SOC-2026-039 (Active - escalated to Tier 3)

192.168.5.88 (Internal Workstation)

Finding ID: DT-2026-001478
Status: New Finding
Confidence: 72%
First Seen: 2026-01-25 10:22:00
Finding Summary:

  • Possible credential stuffing attack
  • No confirmed compromise yet
  • Targeting admin account on 10.0.50.25 (Domain Controller)

MITRE ATT&CK Techniques:

  • T1110.001 - Brute Force: Password Guessing

Related Cases: None (New)

External IPs (Threat Intelligence)

185.220.101.42:

  • Reputation: Malicious (confirmed)
  • First Seen in Threat Intel: 2025-12-10
  • Associated Campaigns: APT-28, Fancy Bear
  • IOC Type: C2 Infrastructure
  • Recommended Action: Block immediately

8.8.8.8 (Google DNS):

  • Reputation: Legitimate
  • Note: May be used for DNS tunneling - requires further analysis

Step 3: Unified Security Report

User Query

Create a unified security report that includes:
1. Summary of high-confidence Splunk incidents
2. Impacted IP addresses
3. DeepTempo threat intelligence for those IPs
4. Recommended actions based on the correlation

Format it as an executive summary suitable for a security manager.

Claude's Response (Example)

SECURITY INCIDENT REPORT

Date: January 25, 2026
Time Period: Last 24 hours
Classification: CRITICAL
Report ID: RPT-2026-0125-001

EXECUTIVE SUMMARY

Our security monitoring systems have detected a coordinated, multi-stage cyber attack affecting internal infrastructure. Analysis indicates this is likely an APT-28 (Fancy Bear) campaign targeting our organization.

Key Findings:

  • 5 high-confidence security incidents detected
  • 2 confirmed compromised systems
  • 1 external C2 infrastructure identified
  • Active data exfiltration detected
  • Connection to known state-sponsored threat actor

Business Impact: HIGH
Recommended Response Level: IMMEDIATE ESCALATION TO INCIDENT RESPONSE TEAM

INCIDENT OVERVIEW

Metric Count Status
Critical Incidents 4 Active
High Priority Incidents 1 Active
Confirmed Compromised Hosts 2 Isolated
Active Investigations 2 In Progress
New Findings 1 Triaging

Timeline

Jan 23, 16:30 - Initial compromise of web server (10.0.10.55)
Jan 24, 09:15 - Workstation compromise detected (192.168.1.100)
Jan 25, 10:22 - Brute force attempts against Domain Controller
Jan 25, 11:55 - Data exfiltration activity observed
Jan 25, 14:32 - Lateral movement to multiple hosts detected

AFFECTED SYSTEMS

Critical Systems (Confirmed Compromise)

1. 192.168.1.100 - Finance Dept Workstation

  • Status: Compromised (Credential Theft)
  • Department: Finance
  • User: jsmith@company.com
  • Attack Vector: Mimikatz credential dumping
  • Current State: Isolated from network
  • Data at Risk: Financial records, credentials

2. 10.0.10.55 - Web Server

  • Status: Compromised (Backdoor/C2)
  • Service: Public-facing web application
  • Attack Vector: Backdoor installation
  • C2 Server: 185.220.101.42 (APT-28 infrastructure)
  • Current State: Isolated, forensics in progress
  • Data at Risk: Customer data, application secrets

Systems Under Investigation

3. 192.168.5.88 - IT Dept Workstation

  • Status: Suspicious Activity (Brute Force)
  • Target: Domain Controller (10.0.50.25)
  • Current State: Monitoring enhanced
  • Recommended Action: Password reset for targeted accounts

THREAT INTELLIGENCE ASSESSMENT

Attribution

Threat Actor: APT-28 (Fancy Bear)
Affiliation: GRU (Russian Military Intelligence)
Motivation: Espionage, Data Theft
Sophistication: Advanced

Attack Chain

1. Initial Access → Web application vulnerability
2. Execution → Backdoor installation
3. Persistence → C2 communications established
4. Credential Access → Mimikatz deployment
5. Lateral Movement → SMB-based spread
6. Exfiltration → Data stolen via C2 channel

MITRE ATT&CK Mapping

  • Credential Access: T1003.001 (LSASS Memory Dumping)
  • Lateral Movement: T1021.002 (SMB/Admin Shares)
  • Command & Control: T1071.001 (Web Protocols)
  • Exfiltration: T1041 (C2 Channel)

RECOMMENDED ACTIONS

IMMEDIATE (Next 1 Hour)

  1. ✅ Isolate confirmed compromised systems (192.168.1.100, 10.0.10.55) - COMPLETED
  2. 🔴 Block C2 IP 185.220.101.42 at firewall - REQUIRED
  3. 🔴 Reset credentials for all users on affected systems - REQUIRED
  4. 🔴 Enable enhanced monitoring on Domain Controller 10.0.50.25 - REQUIRED
  5. 🔴 Notify leadership and activate incident response plan - REQUIRED

SHORT-TERM (Next 24 Hours)

  1. Conduct full forensic analysis of compromised systems
  2. Hunt for additional IOCs across entire network
  3. Review all authentication logs for compromised credentials
  4. Scan for Mimikatz and similar tools across environment
  5. Deploy additional EDR sensors on critical systems

MEDIUM-TERM (Next 7 Days)

  1. Conduct organization-wide password reset
  2. Implement MFA on all critical systems
  3. Review and harden web application security
  4. Update incident response procedures
  5. Conduct tabletop exercise for similar scenarios

LONG-TERM (Next 30 Days)

  1. Implement network segmentation to limit lateral movement
  2. Deploy deception technologies (honeypots/tokens)
  3. Enhance threat intelligence integration
  4. Conduct security awareness training focused on credential hygiene
  5. Review and update security architecture

REGULATORY & COMPLIANCE CONSIDERATIONS

  • Data Breach Notification: Assess if customer/PII data was accessed
  • Regulatory Reporting: Determine requirements based on industry (GDPR, HIPAA, PCI-DSS, etc.)
  • Legal Hold: Preserve all logs and forensic evidence
  • Cyber Insurance: Notify carrier of incident

CONTACT INFORMATION

Incident Commander: [To Be Assigned]
SOC Team: soc@company.com
IR Hotline: +1-555-0100
Severity: CRITICAL
Next Update: 2 hours (17:00 UTC)

Report Prepared By: AI-Assisted Security Investigation (Claude + MCP)
Data Sources: Splunk SIEM, DeepTempo Threat Intelligence Platform
Confidence Level: HIGH (95%+)

APPENDIX: Technical Details

IOCs (Indicators of Compromise)

IPs:
- 185.220.101.42 (External C2)
- 192.168.1.100 (Internal - Compromised)
- 10.0.10.55 (Internal - Compromised)

Tools/Techniques:
- Mimikatz (Credential Dumping)
- SMB Lateral Movement
- PowerShell-based backdoor

Splunk Queries for Ongoing Monitoring

index=* (src_ip=192.168.1.100 OR src_ip=10.0.10.55 OR dest_ip=185.220.101.42)
| stats count by _time src_ip dest_ip action

DeepTempo Case References

  • SOC-2026-042: Finance Department Breach
  • SOC-2026-039: APT-28 Infrastructure Investigation

END OF REPORT

Analysis: Time Saved

Traditional Investigation Time: ~45 minutes

  • Splunk query and analysis: 15 min
  • DeepTempo lookups: 15 min
  • Report writing: 15 min

AI-Assisted Investigation Time: ~5 minutes

  • Three natural language queries to Claude
  • Automatic correlation and report generation

Time Savings: ~40 minutes (89% reduction)

Additional Benefits:

  • More comprehensive analysis
  • Consistent report format
  • Reduced risk of missing correlations
  • Complete audit trail in Claude conversation
  • Easier to share and collaborate

This example demonstrates the power of AI-driven security orchestration! 🚀