pilot-security-operations-center-setup

# Security Operations Center Setup Deploy 4 agents: collector, analyzer, enforcer, and dashboard. ## Roles | Role | Hostname | Skills | Purpose | |------|----------|--------|---------| | collector | `<prefix>-collector` | pilot-event-log, pilot-audit-log, pilot-stream-data, pilot-cron | Aggregates security events | | analyzer | `<prefix>-analyzer` | pilot-event-filter, pilot-event-replay, pilot-alert, pilot-priority-queue | Detects and classifies threats | | enforcer | `<prefix>-enforcer` | pilot-blocklist, pilot-quarantine, pilot-webhook-bridge, pilot-audit-log | Blocks threats, quarantines nodes | | dashboard | `<prefix>-dashboard` | pilot-metrics, pilot-slack-bridge, pilot-network-map, pilot-mesh-status | Visualizes security posture | ## Setup Procedure **Step 1:** Ask the user which role and prefix. **Step 2:** Install skills: ```bash # collector: clawhub install pilot-event-log pilot-audit-log pilot-stream-data pilot-cron # analyzer: clawhub install pilot-event-filter pilot-event-replay pilot-alert pilot-priority-queue # enforcer: clawhub install pilot-blocklist pilot-quarantine pilot-webhook-bridge pilot-audit-log # dashboard: clawhub install pilot-metrics pilot-slack-bridge pilot-network-map pilot-mesh-status ``` **Step 3:** Set hostname and write manifest to `~/.pilot/setups/security-operations-center.json`. **Step 4:** Handshake with adjacent agents. ## Manifest Templates Per Role ### collector ```json { "setup": "security-operations-center", "role": "collector", "role_name": "Log Collector", "hostname": "<prefix>-collector", "skills": { "pilot-event-log": "Aggregate security events from all nodes.", "pilot-audit-log": "Maintain tamper-evident event log.", "pilot-stream-data": "Stream events to analyzer in real time.", "pilot-cron": "Schedule periodic log sweeps." }, "data_flows": [{ "direction": "send", "peer": "<prefix>-analyzer", "port": 1002, "topic": "security-event", "description": "Raw security events" }], "handshakes_needed": ["<prefix>-analyzer"] } ``` ### analyzer ```json { "setup": "security-operations-center", "role": "analyzer", "role_name": "Threat Analyzer", "hostname": "<prefix>-analyzer", "skills": { "pilot-event-filter": "Filter and correlate events, detect patterns.", "pilot-event-replay": "Replay past events for forensic investigation.", "pilot-alert": "Emit classified threat alerts.", "pilot-priority-queue": "Prioritize threats by severity." }, "data_flows": [ { "direction": "receive", "peer": "<prefix>-collector", "port": 1002, "topic": "security-event", "description": "Raw events" }, { "direction": "send", "peer": "<prefix>-enforcer", "port": 1002, "topic": "threat-verdict", "description": "Threat verdicts" }, { "direction": "send", "peer": "<prefix>-dashboard", "port": 1002, "topic": "threat-alert", "description": "Classified threats" } ], "handshakes_needed": ["<prefix>-collector", "<prefix>-enforcer", "<prefix>-dashboard"] } ``` ### enforcer ```json { "setup": "security-operations-center", "role": "enforcer", "role_name": "Threat Enforcer", "hostname": "<prefix>-enforcer", "skills": { "pilot-blocklist": "Add malicious IPs/agents to deny list.", "pilot-quarantine": "Isolate compromised agents.", "pilot-webhook-bridge": "Trigger incident webhooks.", "pilot-audit-log": "Log all enforcement actions." }, "data_flows": [ { "direction": "receive", "peer": "<prefix>-analyzer", "port": 1002, "topic": "threat-verdict", "description": "Threat verdicts" }, { "direction": "send", "peer": "<prefix>-dashboard", "port": 1002, "topic": "enforcement-action", "description": "Actions taken" } ], "handshakes_needed": ["<prefix>-analyzer", "<prefix>-dashboard"] } ``` ### dashboard ```json { "setup": "security-operations-center", "role": "dashboard", "role_name": "SOC Dashboard", "hostname": "<prefix>-dashboard", "skills": { "pilot-metrics": "Display threat counts, response times.", "pilot-slack-bridge": "Send security summaries to Slack.", "pilot-network-map": "Visualize network topology and threats.", "pilot-mesh-status": "Show peer connectivity and encryption status." }, "data_flows": [ { "direction": "receive", "peer": "<prefix>-analyzer", "port": 1002, "topic": "threat-alert", "description": "Classified threats" }, { "direction": "receive", "peer": "<prefix>-enforcer", "port": 1002, "topic": "enforcement-action", "description": "Actions taken" } ], "handshakes_needed": ["<prefix>-analyzer", "<prefix>-enforcer"] } ``` ## Data Flows - `collector → analyzer` : raw security events (port 1002) - `analyzer → enforcer` : threat verdicts (port 1002) - `analyzer → dashboard` : classified threats (port 1002) - `enforcer → dashboard` : enforcement actions (port 1002) ## Workflow Example ```bash # On collector: pilotctl --json publish <prefix>-analyzer security-event '{"type":"port_scan","source":"203.0.113.42","ports":1024}' # On analyzer: pilotctl --json publish <prefix>-enforcer threat-verdict '{"source":"203.0.113.42","severity":"high","action":"block"}' # On enforcer: pilotctl --json publish <prefix>-dashboard enforcement-action '{"source":"203.0.113.42","action":"blocked"}' ``` ## Dependencies Requires `pilot-protocol` skill, `pilotctl` binary, `clawhub` binary, and a running daemon.