Repository navigation
feat(soc-optimization-unified): soc-block-domain containment action - #1200
Merged
Merged
Conversation
New registry action that blocks domains at DNS (ThreatStop) and the web proxy (Zscaler) in one run: dispatch all_applicable fans out to both vendors, once per domain on the issue. Ships shadowed for every actor. Surfaces under the issue Contain button via SOCFWPhaseActions. Tenant facts (ThreatStop list_id, Zscaler category-id, optional instance) are set on the action row, the same list PS edits to flip shadow. Until set, each vendor skips with a reason naming the value. SOCCommandWrapper: - response branches may carry their own target_arg (ioc_domain vs url) - required_args: skip a branch whose tenant config is empty, with reason - action_target now reaches the dataset row; enrich_payload dropped it, so fanned-out rows could not say which target they acted on Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X6z5STKWCdm3aN5XwxWpgz
…ntConfig_V3 Customer-specific vendor values (ThreatStop list_id, Zscaler category-id and instance) move out of the registry row into a tenant-only list, SOCFrameworkTenantConfig_V3, keyed by vendor then arg. The list is never shipped in a pack, so upgrades cannot overwrite it and the registry no longer has to be edited (and detached) to configure an action. The wrapper reads it only for actions that declare required_args, and fills only args the registry ships as empty literals; an arg bound to issue evidence is never overridden. Missing list or value: the vendor skips with a reason naming the value and the list. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X6z5STKWCdm3aN5XwxWpgz
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
New containment action
soc-block-domain: blocks every domain on the issue at DNS (ThreatStop) and the web proxy (Zscaler) in one run. Ships shadowed for every actor. Appears under the issue Contain button viaSOCFWPhaseActions, with no layout or playbook change.Registry row (
SOCFrameworkActions_V3) +indicatorclass + 15-min time-map entry.dispatch: all_applicable: both vendors, once per domain; targetSOCFramework.Artifacts.Network.DNS.Query. The row carries no customer values and never needs editing.Customer values:
SOCFrameworkTenantConfig_V3(tenant-only, never shipped in a pack, so upgrades can't overwrite it):{ "ThreatStopv2": { "list_id": "<block list GUID>" }, "Zscaler": { "category-id": "<custom category>", "using": "<instance, optional>" } }Missing list or value → that vendor skips: "not configured: set list_id for ThreatStopv2 in SOCFrameworkTenantConfig_V3".
SOCCommandWrapper (all opt-in per row; other actions unchanged):
required_args; fills only args the registry ships as empty literals, never an arg bound to issue evidencetarget_arg, since ThreatStop calls itioc_domainand Zscalerurlrequired_args: skip a branch whose customer value is missing, with the reasonaction_targetnow reaches the dataset row. feat(soc-optimization-unified): targets[] expansion and per-action dispatch mode in SOCCommandWrapper #1199 set it butenrich_payloaddropped it.Testing
Unit: suite reads the shipped row from the repo list, 9/9. 6 fail on main's wrapper; 3 pin the shipped row, the no-domain skip, and "config never overrides issue evidence". Existing suites: failure set identical to main (9 pre-existing detonate-file failures).
Gate: green; uploaded to deathstar (soc-optimization-unified 3.25.0).
Live on deathstar, executing the installed scripts against the real installed registry row on issue 1494850 with injected domains
[evil-a, evil-b, evil-a(dup), ""]:list_id,category-id,usingall present in the dispatched argsSOCFWPhaseActions)action_target= the domainRegression (live, same method): 13-case wrapper matrix 13/13; all 11 real containment actions as analyst unchanged.
Not proven here: a real ThreatStop/Zscaler call. deathstar has neither integration.
Known v1 limits: target is
Network.DNS.Queryonly (email-issue URLs aren't domain-extracted yet); no ThreatStopexpires.🤖 Generated with Claude Code
https://claude.ai/code/session_01X6z5STKWCdm3aN5XwxWpgz