SentinelMCP/agents/tier2-agents.yaml at main · eshlomo1/SentinelMCP · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
tier2_agents:
- id: "tier2-malware-analyzer"
  role_id: "t2-malware-analysis"
  name: "Tier2-MalwareAnalyzer"
  role: "Malware & File Analysis"
  description: "Analyzes suspicious files, processes, and behaviors for malware indicators"
  capabilities:
  - file_analysis
  - process_behavior_analysis
  - sandbox_execution
  - signature_matching
  - behavioral_analysis
  - detonation_analysis
  data_sources:
  - file_hashes
  - process_memory_dumps
  - network_artifacts
  - endpoint_telemetry
  output_format: "malware_analysis_report"
  skills:
  - malware_analysis
  - reverse_engineering
  - behavior_analysis
  - sandbox_integration
  - yara_rule_creation
  integration_points:
  - virustotal_api
  - hybrid_analysis
  - falcon_sandbox
  sla_response_time: "30 minutes"
  success_metrics:
  - detection_accuracy: 98%
  - analysis_completeness: 95%
  - false_negative_rate: "< 2%"

- id: "tier2-network-investigator"
  role_id: "t2-network-investigation"
  name: "Tier2-NetworkInvestigator"
  role: "Network Anomaly Investigation"
  description: "Investigates suspicious network connections, traffic patterns, and communication anomalies"
  capabilities:
  - network_behavior_analysis
  - flow_correlation
  - dns_analysis
  - ip_reputation_lookup
  - communication_pattern_analysis
  - lateral_movement_detection
  data_sources:
  - network_flows
  - dns_logs
  - proxy_logs
  - firewall_logs
  - endpoint_network_events
  output_format: "network_investigation_report"
  skills:
  - network_analysis
  - dns_analysis
  - threat_intelligence_correlation
  - graph_analysis
  - communication_profiling
  sla_response_time: "20 minutes"
  success_metrics:
  - anomaly_detection_rate: 92%
  - c2_detection_accuracy: 95%

- id: "tier2-identity-analyzer"
  role_id: "t2-identity-analysis"
  name: "Tier2-IdentityAnalyzer"
  role: "Identity & Authentication Analysis"
  description: "Analyzes authentication events, identity risks, and access pattern anomalies"
  capabilities:
  - sign_in_analysis
  - lateral_movement_detection
  - privilege_escalation_detection
  - account_compromise_detection
  - user_behavior_baseline_analysis
  data_sources:
  - sign_in_logs
  - audit_logs
  - privileged_access_logs
  - user_activity
  - entra_id_logs
  output_format: "identity_risk_report"
  skills:
  - identity_risk_assessment
  - anomalous_behavior_detection
  - privilege_escalation_analysis
  - user_profiling
  sla_response_time: "15 minutes"
  success_metrics:
  - compromise_detection_rate: 90%
  - false_positive_rate: "< 5%"

- id: "tier2-threat-assessor"
  role_id: "t2-threat-assessment"
  name: "Tier2-ThreatAssessor"
  role: "Threat Assessment & Tier 3 Escalation Authority"
  description: "Assesses overall threat severity, consolidates Tier 2 findings, and determines if escalation to Tier 3 (Forensic) is required; primary escalation decision authority for Tier 2"
  capabilities:
  - severity_scoring
  - impact_analysis
  - risk_quantification
  - escalation_decision
  - incident_correlation
  - findings_consolidation
  - forensic_coordination
  escalation_to: "tier3"
  escalation_authority: true
  escalation_criteria:
    automatic_triggers:
    - "CONFIRMED_INCIDENT_WITH_DATA_BREACH"
    - "3_PLUS_SYSTEMS_COMPROMISED"
    - "ADVANCED_PERSISTENT_THREAT_INDICATORS"
    - "RANSOMWARE_ACTIVITY_DETECTED"
    - "INSIDER_THREAT_CONFIRMED"
    - "UNKNOWN_PERSISTENCE_MECHANISM"
    - "INCOMPLETE_LATERAL_MOVEMENT_SCOPE"
    - "LEGAL_FORENSIC_REQUIREMENTS"
    escalation_rationale: "Automatic escalation to Tier 3 Forensic team"
    sla_response_time: "30 minutes to 4 hours"
  assessment_factors:
  - asset_criticality
  - data_sensitivity
  - number_of_affected_systems
  - threat_actor_capability
  - business_context
  - forensic_analysis_necessity
  output_format: "threat_assessment_report"
  skills:
  - risk_assessment
  - impact_analysis
  - business_context_analysis
  - escalation_decision_making
  - findings_consolidation
  - forensic_case_preparation
  sla_response_time: "30 minutes"
  success_metrics:
  - escalation_accuracy: 96%
  - assessment_consistency: 94%
  - false_positive_identification: 95%