feat(nist-ir): NIST IR contract and detection surface for AI analysis - #1052
Merged
Conversation
XDR Analytics never populates the mitre*name/*id fields the canonical rows read — it emits the fused mitreattck* form, present on every alert. Adds the detector's own metadata (action, detection_module, alert_domain, detection_details) and sources alert_source from the case, since sourceBrand reads MAGNIFIER on every analytics alert. Investigation.RiskScore/IssueCount/UserCount/HostCount/LinkedCount were declared as analysis reads in SOCFrameworkPhaseContract_V3 but had no writer; the case carries all of them.
Artifacts.Source.{Action,Module,AlertDomain} already exist in the
endpoint band and are what the prompts bind; the identity rows minted
duplicates under new names that nothing reads.
The case scope counts, the case/issue MITRE, and the detector's own metadata carry the same meaning regardless of product category, but only endpoint and identity had any of them. Adds the block to all six bands. Artifacts.Source.Details replaces the category-flavoured Identity.detection_details — Artifacts.Source.* is already the shared detector namespace.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Five commits of NIST IR contract work, all in
soc-framework-nist-ir. Everything here is running on a dev tenant and gated green with upload.What is in it
e83a43benrich the identity contract for AI analysis075a979use the existingArtifacts.Source.*targets26bb51eapply the shared detection surface to every bandae9776eextend the endpoint detection surface65ca290retarget the Abnormal + Defender scenario at deathstarThe normalize map grows substantially against
main: endpoint 101 -> 141, email 59 -> 74, identity 55 -> 70, network 55 -> 70, cloud 47 -> 62, generic 40 -> 55. The endpoint additions includeEndpoint.alert_sourcefromcase.incident_sources.[0]andArtifacts.Process.Namefromactor_process_image_name.The scenario commit swaps the two source envs from
.env-brumxdr-*to.env-deathstar-*. Without it the manifest points at brumxdr and none of the AI analysis runs behind this work are reproducible.Why it matters now
The AI Analysis prompts read almost entirely from the normalized surface — 37 of the 45 endpoint prompt bindings resolve from
SOCFramework.*. Verdict quality is a direct function of how much of this map is populated, which is what four replays on deathstar this evening demonstrated.mainis currently 40 endpoint mappings behind what the tenant runs, so a Package Manager install from the released pack takes a tenant backwards.Verification
check_contributiongreen with upload against deathstar, all stages: normalize, correlation_rule_preflight, playbook_condition_lint, pack_prep, fix_errors, check_contracts, validate_shadow_mode, prep_docs, upload. The list on the tenant is byte-identical to the committed file.Labelled
version:patch-> 1.8.2. Note #1051 carries the same label against the same pack; whichever merges second is the one that bumps.