Add SOC IR Playbook Library web application with MITRE ATT&CK integration

[vector1one]

Summary

This PR introduces a complete web-based SOC Incident Response Playbook Library application with MITRE ATT&CK framework integration, threat group profiles, and multi-tool/SIEM query generation support.

Key Changes

Core Application

• New web application (app/app.js, app/index.html) - Full-featured playbook library interface with:
  • 42+ incident response playbooks covering malware, cloud, identity, data exfiltration, and supply chain threats
  • 100+ threat group profiles (APT groups, ransomware operators)
  • Multi-tool support: Splunk SPL, KQL, QRadar AQL, Sigma, Sysmon, Velociraptor, OSQuery, Elastic EQL, Chronicle, CrowdStrike, and more
  • MITRE ATT&CK Navigator integration for technique visualization
  • Playbook search, filtering, and categorization

Playbook Library

• Manifest system (app/playbooks/manifest.json) - Centralized registry of all playbooks with metadata (ID, severity, MITRE techniques, related playbooks)
• 42 incident response playbooks organized by category:
  • Malware (ransomware, USB-based, LOLBins)
  • Cloud security (account compromise, misconfiguration, lateral movement)
  • Identity & access (credential attacks, privilege escalation, MFA bypass)
  • Data protection (exfiltration, database access, DNS tunneling)
  • Supply chain (CI/CD exploitation, third-party vulnerabilities)
  • Application security (web exploitation, API attacks, JavaScript injection)
  • Network attacks (DDoS, ARP spoofing, DNS attacks)
• 100+ threat group playbooks - MITRE ATT&CK group profiles with techniques and TTPs

MITRE ATT&CK Integration

• Techniques database (app/playbooks/mitre-techniques.json) - Comprehensive MITRE ATT&CK technique reference
• Generation scripts (scripts/generate-mitre-techniques.mjs, scripts/generate_mitre_group_playbooks.py) - Automated playbook generation from MITRE data
• Elastic Detection Rules generator (scripts/generate_elastic_detection_rules.py) - Tool-specific query generation

Backend & Infrastructure

• CGI scripts for playbook management:
  • load_playbooks.sh - Load playbook library
  • save_playbook.sh - Create custom playbooks
  • update_playbook.sh - Modify existing playbooks
  • delete_playbook.sh - Remove playbooks
  • get_config.sh - Retrieve active tool configuration
• Docker improvements - Multi-stage build with Node.js for MITRE data generation
• Project structure - Organized playbook directories by threat category

Configuration & Documentation

• Updated Dockerfile with MITRE technique generation build stage
• Updated README.md with application overview
• Added .dockerignore and .gitignore for cleaner builds
• Updated docker-compose.yml for application deployment

Notable Implementation Details

• Playbooks include detection queries for multiple SIEM/tool platforms
• Each playbook contains investigation steps, detection methods, and remediation guidance
• MITRE ATT&CK technique mapping enables cross-referencing with threat intelligence
• Modular architecture allows easy addition of new playbooks and threat groups
• Support for both library playbooks and user-created custom playbooks

https://claude.ai/code/session_01TjKtRapWpjp13ZPwHTCMix