Prompts de monitoramento de segurança e resposta a incidentes

Design a SIEM architecture for [organization size] using [Splunk/ELK/Azure Sentinel/Chronicle/QRadar]. Include:
- Log sources and collection strategy (endpoints, network, cloud, applications, identity)
- Log forwarding architecture (agents, syslog, API)
- Data retention policy (90 days hot, 1 year warm, 7 years cold for compliance)
- Parsing and normalization rules
- Correlation rules for threat detection
- Dashboard design (SOC, executive, compliance)
- User access controls (analyst, admin, auditor roles)
- High availability and disaster recovery
- Sizing and cost estimation
- Integration with SOAR and ticketing

Map to ISO 27001 A.12.4, SOC 2 CC7.2, NIST SP 800-92.

Create a SOC implementation plan for [organization type]. Include:
- SOC model (in-house, outsourced, hybrid, virtual)
- Team structure and roles (Tier 1/2/3 analysts, manager, threat intel)
- Technology stack (SIEM, EDR, SOAR, threat intel, case management)
- Operating procedures (shift schedule, escalation, handoffs)
- Playbooks for common scenarios
- Metrics and KPIs (MTTD, MTTR, false positive rate, coverage)
- Training and skill development plan
- Integration with incident response and IT operations
- Continuous improvement process
- Compliance requirements (ISO 27001 A.16.1, SOC 2 CC7.3)

Output as implementation roadmap and budget estimate.

Design a log management strategy for [environment]. Include:
- Log sources inventory (by criticality and compliance requirement)
- Collection methods (native logging, agents, forwarders)
- Log format standardization (JSON, CEF, syslog)
- Centralized storage architecture
- Retention policy by log type (security: 1 year, compliance: 7 years, operational: 90 days)
- Access controls and encryption
- Backup and disaster recovery for logs
- Search and analysis capabilities
- Cost optimization (tiered storage, compression)
- Compliance mapping (ISO 27001 A.12.4.1, SOC 2 CC7.2, GDPR Art. 30)

Include storage sizing calculator and retention matrix.

Create security alert rules for [SIEM platform] covering [environment type]. Include rules for:
- Failed authentication (threshold-based, account lockout)
- Privilege escalation and sudo usage
- Anomalous network traffic (data exfiltration, C2 communication)
- Malware and ransomware indicators
- Insider threat behaviors (unusual file access, after-hours activity)
- Cloud misconfigurations (public S3, disabled logging)
- Vulnerability exploitation attempts
- DDoS and denial of service
- Data breach indicators
- Compliance violations

For each rule, specify: severity, condition, threshold, correlation logic, and response action. Map to MITRE ATT&CK framework.

Design User and Entity Behavior Analytics (UEBA) for [organization]. Include:
- Baseline behavior modeling (per user, per system)
- Anomaly detection algorithms (statistical, machine learning)
- Risk scoring methodology
- Use cases (compromised account, insider threat, lateral movement)
- Integration with SIEM and identity systems
- Alert tuning and false positive reduction
- Investigation workflow for anomalies
- Continuous model training and improvement
- Privacy considerations (anonymization, data minimization)
- Compliance alignment (ISO 27001 A.16.1, SOC 2 CC7.3)

Output as technical specification and deployment plan.

Create threat intelligence program for [organization]. Include:
- Intelligence sources (commercial feeds, open source, ISACs, government)
- Indicators of Compromise (IOC) types (IP, domain, hash, URL, email)
- Integration with security tools (SIEM, firewall, EDR, email gateway)
- Automated IOC enrichment and contextualization
- Threat actor and campaign tracking
- Intelligence sharing participation (anonymized contribution)
- Analyst workflow for intelligence consumption
- Metrics (IOC hit rate, threat coverage, MTTD improvement)
- Platform selection ([MISP/ThreatConnect/Anomali/commercial])
- STIX/TAXII implementation

Align with ISO 27001 A.16.1.4, SOC 2 CC7.3.

Design EDR/XDR deployment for [organization] using [CrowdStrike/SentinelOne/Microsoft Defender/Carbon Black]. Include:
- Deployment scope (workstations, servers, cloud workloads, containers)
- Agent deployment method (GPO, SCCM, Intune, cloud init scripts)
- Configuration and policy settings
- Detection and prevention mode strategy
- Integration with SIEM and SOAR
- Alert triage and investigation workflow
- Threat hunting capabilities
- Automated response actions (isolate, quarantine, kill process)
- Performance impact assessment and tuning
- Compliance evidence collection (ISO 27001 A.12.2, SOC 2 CC7.2)

Include deployment timeline and success criteria.

Create endpoint monitoring and hardening strategy for [OS types]. Include:
- Security baseline configuration (CIS Benchmarks)
- Monitoring requirements (process execution, network connections, file changes, registry modifications)
- Application allowlisting/blocklisting
- Removable media controls
- Full disk encryption enforcement
- Antivirus/antimalware configuration
- Firewall rules
- Patch management integration
- Configuration drift detection
- Audit logging and forwarding to SIEM

Map to ISO 27001 A.8.9, A.12.2, A.12.6, SOC 2 CC6.8.

Create a comprehensive incident response plan for [organization] compliant with [ISO 27001/SOC 2/GDPR/NIST]. Include:
- Incident response team structure (CIRT/CSIRT) and roles
- Incident classification and severity levels
- Response phases (Preparation, Detection, Analysis, Containment, Eradication, Recovery, Post-Incident)
- Communication plan (internal escalation, external notification, media)
- Decision trees for common incident types
- Evidence preservation and chain of custody
- Legal and regulatory notification requirements (GDPR 72 hours)
- Business continuity integration
- Tabletop exercise schedule (quarterly)
- Continuous improvement process
- Compliance documentation (ISO 27001 A.17.1, SOC 2 CC7.4-CC7.5)

Output as plan document and quick reference guide.

Generate incident response playbooks for [incident types]. For each, include:

1. Ataque de ransomware
2. Violação/exfiltração de dados
3. Phishing/Comprometimento de Email Corporativo
4. Ataque DDoS
5. Ameaça interna
6. Infecção por malware
7. Credenciais comprometidas
8. Tomada de conta em nuvem
9. Comprometimento da cadeia de suprimentos
10. Exploração de zero-day

Each playbook should cover: detection indicators, immediate containment steps, investigation procedures, eradication actions, recovery process, stakeholder communication, and lessons learned template.

Map to ISO 27001 A.17.1, SOC 2 CC7.4, NIST SP 800-61.

Design incident ticketing system for security events using [Jira/ServiceNow/TheHive/custom]. Include:
- Ticket fields (severity, category, affected systems, timeline, actions taken)
- Workflow states (New → Assigned → Investigating → Contained → Resolved → Closed)
- SLA by severity (Critical: 1 hour response, High: 4 hours, etc.)
- Assignment rules and escalation
- Integration with SIEM and SOAR (auto-ticket creation)
- Evidence attachment and documentation
- Reporting and metrics dashboard
- Audit trail for compliance
- Post-incident review tracking
- Knowledge base integration

Align with ISO 27001 A.17.1, SOC 2 CC7.4.

Create digital forensics procedures for [organization]. Include:
- Forensic readiness program (logging, retention, tools)
- Evidence identification and preservation
- Chain of custody documentation
- Forensic imaging (disk, memory, network)
- Analysis tools and techniques
- Legal and regulatory considerations
- Reporting format and findings documentation
- Third-party forensic firm engagement criteria
- Training requirements for IR team
- Lab setup (physical or cloud-based)
- Compliance requirements (ISO 27001 A.17.1.3)

Output as procedure document and evidence collection kit checklist.

Design malware analysis capability for [organization]. Include:
- Triage process (automated sandbox analysis)
- Static analysis techniques (strings, PE analysis, decompilation)
- Dynamic analysis (isolated VM, behavior monitoring)
- Reverse engineering tools and skills
- IOC extraction and documentation
- Threat intelligence correlation
- Findings dissemination (internal alert, IOC sharing)
- Safe handling procedures
- Commercial vs. in-house capability decision
- Integration with incident response

Map to ISO 27001 A.16.1, SOC 2 CC7.3.

Create incident communication plan for [organization]. Address:
- Stakeholder identification (executives, legal, PR, customers, regulators, employees)
- Communication triggers and timing by severity
- Message templates (internal notification, customer notification, regulatory report, public statement)
- Approval workflow and authorized spokespersons
- Channel selection (email, portal, press release, social media)
- Escalation criteria
- Legal review requirements
- Translation needs for global organizations
- Post-incident communication (all-clear, lessons learned)
- Compliance with notification laws (GDPR Art. 33-34, state breach laws)

Include templates and contact list.

Design GDPR-compliant data breach notification procedure. Include:
- Breach detection and initial assessment (within hours)
- Severity classification (high risk to rights and freedoms?)
- 72-hour notification to supervisory authority (DPA) requirements
- Individual notification criteria and methods
- Required information in notifications (nature, consequences, measures)
- Documentation requirements (breach register)
- DPO involvement and coordination
- Cross-border breach handling (lead authority)
- Exemptions (encryption, minimal risk)
- Post-notification regulatory interaction

Map to GDPR Articles 33-34, ISO 27001 A.17.1.

Define security operations metrics for [organization]. Include:

Detection metrics:
- Tempo Médio para Detectar (MTTD)
- Volume de alertas e taxa de falsos positivos
- Cobertura (% de ativos monitorados)
- Precisão na detecção de ameaças

Response metrics:
- Tempo Médio para Responder (MTTR)
- Tempo Médio para Conter (MTTC)
- Volume de incidentes por gravidade
- Taxa de conformidade com SLA

Operational metrics:
- Tempo de atividade do SIEM e taxa de ingestão de dados
- Backlog de tickets do SOC
- Taxa de escalonamento
- Utilização da equipe

Program metrics:
- Conclusão de exercícios de mesa
- Cobertura de manuais
- Conclusão de treinamentos
- Resultados de auditorias

Include dashboard design and reporting frequency. Map to ISO 27001 A.18.2.3, SOC 2 CC4.1.

Create post-incident review process for [organization]. Include:
- Critérios para acionar a revisão (todos os incidentes, limite de gravidade)
- Participantes da reunião (equipe de RI, equipes afetadas, gestão)
- Modelo de revisão (linha do tempo, causa raiz, eficácia da resposta, lacunas)
- Princípios de cultura sem culpa
- Rastreamento de itens de ação e responsabilização
- Recomendações de melhoria de processos
- Atualização de documentação e base de conhecimento
- Análise de métricas (tendências de MTTD, MTTR)
- Acompanhamento agendado das ações
- Documentação de conformidade (ISO 27001 A.17.1.3, SOC 2 CC7.5)

Output as review template and action tracking spreadsheet.

Design proactive threat hunting program for [organization]. Include:
- Funções e habilidades da equipe de caça
- Metodologia de caça baseada em hipóteses
- Fontes de dados e plataformas de caça
- Cenários de caça alinhados ao cenário de ameaças
- Ferramentas e técnicas (consultas no SIEM, EDR, análise de rede)
- Cadência (caças semanais, campanhas mensais)
- Documentação de achados (mesmo que nenhuma ameaça seja encontrada)
- Desenvolvimento de biblioteca de IOCs e TTPs
- Integração com inteligência de ameaças
- Métricas (ameaças descobertas, redução do tempo de permanência)
- Valor de conformidade (ISO 27001 A.16.1, SOC 2 CC7.3)

Include hunt scenario templates and reporting format.

Create deception technology strategy using [honeypots/honeytokens/canary tokens]. Include:
- Locais de implantação (segmentos de rede, nuvem, endpoints)
- Tipos de iscas (servidores falsos, bancos de dados, credenciais, documentos)
- Níveis de interação (baixa/média/alta interação)
- Integração de alertas com SIEM
- Coleta de inteligência de ameaças a partir da atividade do invasor
- Considerações legais e de privacidade
- Manutenção e atualização das iscas
- Diferenciação da produção (evitar acesso acidental)
- Análise de técnicas do invasor
- Justificativa de ROI

Map to ISO 27001 A.16.1, SOC 2 CC7.3.