cyber-riposte - AI-agent-driven defensive security response — sand

项目说明

Cyber Riposte

A sandbox of ideas for AI-agent-dri security response. The concept: an AI agent monitors telemetry data (auth logs, DNS query logs, IDS alerts, cluster events) and, when it detects ad activity, opens a pull request with the appropriate countermeasure — a firewall rule change, a DNS sinkhole entry, a new NetworkPolicy, etc.

The human stays in the loop via code review. The agent proposes; the operator approves and merges.

> This is an ideas repo — templates, sketches, and reference implementations to explore the pattern. Nothing here is production-hardened.

The Pattern

Playbooks

Reactive — Respond to obser

| # | Directory | Agent Response | Trigger Signal |
|---|-----------|---------------|----------------|
| 1 | 01-auto-block | PR an nftables drop rule for offending IPs | Auth failure spike from a single source |
| 2 | 02-honeypot-reroute | PR a DNAT rule + honeypot stack | Reconnaissance patterns against prod services |
| 3 | 03-dns-sinkhole | PR a sinkhole entry for a C2 domain | DNS queries matching threat intel IOCs |
| 4 | 04-canary-tokens | PR new tripwire files into sensiti | Post-compromise access to decoy credentials |
| 5 | 05-k8s-microsegment | PR a NetworkPolicy to isolate a compromised pod | Anomalous east-west traffic in a cluster |
| 6 | 06-suricata-response | PR a custom Suricata rule for a new attack pattern | No signatures in IDS telemetry |

Predictive — Act before the attack succeeds

| # | Directory | Agent Response | Trigger Signal |
|---|-----------|---------------|----------------|
| 7 | 07-credential-stuffing-forecast | PR rate limits + temporary MFA enforcement | Distributed login failures across many IPs targeting common accounts |
| 8 | 08-lateral-mo | PR preempti rules to cut predicted pi | Single host compromised — agent maps likely next targets |
| 9 | 09-dns-entropy-detection | PR sinkhole for statistically anomalous domains | High-entropy DNS queries (tunneling fingerprint, no threat intel match) |
| 10 | 10-c | PR WAF/IDS rules for predicted exploit pattern | New C, affected services found in in, no public exploit yet |
| 11 | 11-egress-baseline | PR egress restriction for de workload | New destination, off-hours traffic, or spike baseline |
| 12 | 12- | PR graduated response (block/rate-limit/challenge) | Source IP belongs to known /Tor, hitting sensiti |

Why PRs Instead of Direct Action?

End-to-End Scenario: The Mirror

The scenario-the-mirror directory contains a fully worked example that ties the playbooks together: an AI agent detects an attacker scanning your infrastructure, silently redirects them to a honeypot, and simultaneously runs passi on the attacker's own IP. The result is a PR that contains both the block rule *and* a full intelligence dossier on the attacker.

> *"In fencing, a riposte uses your opponent's forward momentum against them. The Mirror is a digital riposte — they scanned us, so we scanned them back."*

See TALK.md for the 5-minute presentation .

What This Repo Is (and Isn't)

Is: A collection of templates and ideas for how an AI agent could propose defensi as code. A starting point for discussion and experimentation.

Isn't: A production framework, a deployable agent, or a substitute for a SOC. The scripts and configs here are intentionally simple to fit on a presentation slide and spark con.

Disclaimer

This repository is a collection of ideas de for the *Cyber Riposte* presentation. The techniques and countermeasures described here are largely for entertainment and educational purposes — they are meant to spark discussion about what AI-dri security could look like, not to serve as production-ready implementations.

Do not implement any of these techniques without a thorough review by your organization's legal, compliance, and security teams. Acti measures — particularly those in traffic redirection, honeypots, and counter-reconnaissance — may ha implications that vary by jurisdiction. E OSINT collection should be re against your organization's policies and applicable regulations before deployment.

This repository is not legal advice. When in doubt, consult appropriate parties before acting on any ideas presented here.

项目信息

开发语言：Python

Star 数：3

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕AI-agent-driven defensive security response — sandbox of ideas for the Cyber Riposte presentation展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。