Elevating Cybersecurity to a Superhuman Level

// triage.ts — Detection-driven auto-triage
//
// A CrowdStrike Falcon detection fires this script. The "security/triage@v3"
// agent READS & enriches only (VirusTotal IOC reputation, CrowdStrike host
// context, M365 identity) and returns a structured verdict. The SCRIPT does
// every write: it upserts/dedups the incident on (vendor, external_id),
// attaches enriched observables, sets severity, and routes — page on-call for
// true positives, auto-close the rest.

import { defineScript, fetchPayload } from "lunex:sdk"
import { agents } from "lunex:ai"
import { incidents } from "lunex:incidents"
import { notify } from "lunex:script/lib/notify"

// The structured verdict the agent submits via its output schema. The agent
// only recommends; it performs no writes.
interface Observable {
  type: string
  value: string
  enrichment?: unknown
}
interface Verdict {
  severity: "info" | "low" | "medium" | "high" | "critical"
  summary: string
  isTruePositive: boolean
  observables: Observable[]
}

export default defineScript(async (event) => {
  // Pull the full detection record for the agent to reason over.
  const detection = await fetchPayload(event)

  // (1) The agent enriches (read-only tools) and returns its verdict.
  const { output: verdict } = await agents.run<Verdict>("security/triage@v3", {
    event,
    detection,
  })

  // (2) The SCRIPT acts on the recommendation — find-or-create, then enrich.
  const { incident, created } = await incidents.upsert("crowdstrike", event.composite_id, {
    title: event.name,
    severity: verdict.severity,
    source: { vendor: "crowdstrike", event_type: event.event_type, ref: event.composite_id },
  })
  for (const obs of verdict.observables) {
    await incident.addObservable(obs.type, obs.value, obs.enrichment) // idempotent
  }
  await incident.comment(`Auto-triage (security/triage@v3): ${verdict.summary}`)
  await incident.attachRun() // link this run for the audit trail

  // (3) Route: page on-call for high-severity true positives, else close benign.
  if (verdict.isTruePositive && (verdict.severity === "high" || verdict.severity === "critical")) {
    await notify(`🚨 ${verdict.severity.toUpperCase()} — ${event.name}\n${verdict.summary}`)
  } else if (!verdict.isTruePositive) {
    await incident.resolve("false_positive")
  }
  console.log(`Incident ${incident.id} ${created ? "created" : "updated"} (severity=${verdict.severity})`)
})

// investigation.ts — Agent-system deep investigation of a flagged incident
//
// A flagged incident (e.g. routed here by triage) runs this script. It calls an
// Agent System orchestrator ("soc/investigation@v2"). The orchestrator fans out
// to member agents that run in PARALLEL — IOC reputation (VirusTotal), host
// context (CrowdStrike), identity & sign-ins (M365) — aggregates their findings,
// and returns a structured assessment. The SCRIPT then records the investigation
// on the incident and pivots on shared IOCs to correlate related cases. The
// analyst works the case in the UI afterwards.

import { defineScript } from "lunex:sdk"
import { systems } from "lunex:ai"
import { incidents, observables } from "lunex:incidents"

// Aggregated output the orchestrator submits via the system's output schema.
interface EnrichedObservable {
  type: string
  value: string
  verdict: string
  findings?: unknown
}
interface Investigation {
  summary: string
  riskScore: number // 0–100, aggregated across member agents
  observables: EnrichedObservable[]
}

export default defineScript(async (event) => {
  // The flagged incident id arrives on the triggering event; load the handle.
  const incident = await incidents.get(event.incident_id)

  // Run the orchestrator. Member sub-agents run in parallel server-side and are
  // correlated to this system run; the script only sees the aggregated output.
  const { output: result, run_id } = await systems.run<Investigation>("soc/investigation@v2", {
    incident: { id: incident.id, title: incident.title, severity: incident.severity },
  })

  // Record the investigation on the incident: attach enriched observables, drop
  // a timeline comment, and link this run.
  for (const obs of result.observables) {
    await incident.addObservable(obs.type, obs.value, { verdict: obs.verdict, findings: obs.findings })
  }
  await incident.comment(`Investigation (soc/investigation@v2, run ${run_id}) — risk ${result.riskScore}/100\n${result.summary}`)
  await incident.attachRun()

  // Pivot on each shared IOC to surface related incidents, then note the
  // correlations on the timeline for the analyst.
  const related = new Set<string>()
  for (const obs of result.observables) {
    const hits = await observables.findIncidents(obs.type, obs.value)
    for (const h of hits) if (h.id !== incident.id) related.add(h.id)
  }
  if (related.size > 0) {
    await incident.comment(`Correlated ${related.size} related incident(s) via shared IOCs: ${[...related].join(", ")}`)
  }

  // Hand the enriched case to the analyst.
  if (incident.status === "new") await incident.setStatus("in_progress")
  console.log(`Investigation recorded on ${incident.id}; ${related.size} related, risk ${result.riskScore}`)
})

// response.ts — Approval-gated remediation for a confirmed true positive
//
// A high-severity true-positive verdict runs this script (the AI recommended
// upstream; every action below is the SCRIPT's). It reads the response plan from
// storage, gates on an on-call approval, then remediates step by step — contain
// the host (CrowdStrike EDR isolation), disable the user + revoke sign-in
// sessions (M365 / Entra ID), and notify the team — then updates and resolves
// the incident. There is NO block-IOC step.

import { defineScript } from "lunex:sdk"
import { kv } from "lunex:storage"
import { incidents } from "lunex:incidents"
import { crowdstrike, microsoft365 } from "lunex:integrations"
import { waitForApproval } from "lunex:script/lib/approve"
import { notify } from "lunex:script/lib/notify"

interface ResponsePlan {
  deviceIds: string[] // CrowdStrike device ids to isolate
  userUpns: string[] // Entra ID users to disable + revoke
}

export default defineScript(async (event) => {
  const incident = await incidents.get(event.incident_id)
  const plan = await kv.get<ResponsePlan>(`response/plan/${incident.id}`)
  if (!plan) return

  // Approval gate: block until an on-call engineer approves containment.
  const approved = await waitForApproval(incident.id)
  if (!approved) {
    await incident.comment("Containment not approved — no action taken.")
    return
  }

  // Remediate step by step — contain hosts, disable + revoke users, notify team.
  const containment = await crowdstrike.containHost(plan.deviceIds) // ActionResult[] { id, success, error }
  for (const upn of plan.userUpns) {
    await microsoft365.disableUser(upn)
    await microsoft365.revokeSignInSessions(upn)
  }
  await notify(`🛡️ Remediating ${incident.id}: isolated ${plan.deviceIds.length} host(s), disabled ${plan.userUpns.length} user(s).`)

  const isolated = containment.filter((r) => r.success).map((r) => r.id)

  // Update + resolve the incident as a remediated true positive.
  await incident.comment(`Remediated: isolated host(s) ${isolated.join(", ") || "none"}; disabled ${plan.userUpns.join(", ")}.`)
  await incident.resolve("true_positive")
  console.log(`Incident ${incident.id} remediated and resolved (${isolated.length} hosts isolated)`)
})