mirror of
https://github.com/FunnyWolf/agentic-soc-platform.git
synced 2026-08-22 13:12:56 +02:00
71 lines
2.7 KiB
Python
71 lines
2.7 KiB
Python
import random
|
|
|
|
# 运行参数
|
|
EPS = 10
|
|
BATCH_SIZE = 100
|
|
MALICIOUS_PERCENTAGE = 0.05 # 5% 的日志为恶意/异常日志
|
|
|
|
# 索引/来源定义
|
|
NET_INDEX = "siem-network-traffic"
|
|
HOST_INDEX = "siem-host-events"
|
|
CLOUD_INDEX = "siem-aws-cloudtrail"
|
|
|
|
# 实体池
|
|
# --- 基础实体扩展 ---
|
|
USERS = [
|
|
"admin", "root", "system", "network-service", "guest",
|
|
"a.wang", "b.li", "c.zhang", "d.liu", "e.chen", "j.smith", "m.garcia",
|
|
"svc_deploy", "svc_backup", "svc_monitor", "svc_jenkins", "svc_sql",
|
|
"dev_01", "dev_02", "dev_03", "ops_primary", "ops_oncall",
|
|
"sec_audit", "tester_qa", "temp_contractor", "bot_scanner"
|
|
]
|
|
|
|
HOSTS = [
|
|
"srv-web-prod-01", "srv-web-prod-02", "srv-web-staging-01",
|
|
"srv-db-master", "srv-db-slave-01", "srv-db-slave-02",
|
|
"app-api-v1", "app-api-v2", "app-worker-01", "app-worker-02",
|
|
"cache-redis-01", "cache-memcached-01",
|
|
"gw-firewall-ext", "gw-vpn-server", "jump-bastion-01",
|
|
"workstation-win10-01", "workstation-mac-12", "workstation-linux-05"
|
|
]
|
|
|
|
# HOSTS = ["srv-web-prod-01", "srv-web-prod-02", "srv-web-staging-01"]
|
|
INTERNAL_IPS = [f"10.0.0.{i}" for i in range(1, 51)] + [f"192.168.1.{i}" for i in range(100, 151)]
|
|
|
|
EXTERNAL_IPS = [
|
|
"8.8.8.8", "8.8.4.4", "1.1.1.1", "208.67.222.222", # Public DNS
|
|
"45.33.22.11", "104.21.11.22", "13.234.56.78", # Cloud IPs
|
|
"185.220.101.44", "193.23.181.2", # Known Tor/Proxy nodes (Mock)
|
|
] + [f"{random.randint(1, 254)}.{random.randint(1, 254)}.{random.randint(1, 254)}.{random.randint(1, 254)}" for _ in range(5)]
|
|
|
|
PROCESSES = [
|
|
"nginx", "apache2", "mysql", "postgresql", "redis-server",
|
|
"python3", "java", "node", "go", "php-fpm",
|
|
"powershell.exe", "cmd.exe", "bash", "zsh", "ssh", "scp",
|
|
"lsass.exe", "svchost.exe", "services.exe", "wininit.exe",
|
|
"curl", "wget", "nmap", "nc", "metasploit", "mimikatz.exe",
|
|
"crond", "syslogd", "docker-containerd", "kubelet"
|
|
]
|
|
|
|
# 云环境实体池
|
|
# --- 云环境实体扩展 ---
|
|
AWS_ACCOUNTS = [f"12345678{i:04d}" for i in range(1, 3)]
|
|
|
|
IAM_USERS = ["admin-cli", "terraform-executor", "github-actions-role", "iam-user-01"]
|
|
|
|
REGIONS = [
|
|
"us-east-1", "us-west-2", "eu-central-1", "eu-west-1",
|
|
"ap-southeast-1", "ap-northeast-1", "cn-north-1", "sa-east-1"
|
|
]
|
|
|
|
EVENT_NAMES = [
|
|
# Compute
|
|
"RunInstances", "StopInstances", "TerminateInstances", "ModifyInstanceAttribute",
|
|
# IAM
|
|
"CreateUser", "DeleteUser", "CreateAccessKey", "UpdateAssumeRolePolicy", "AttachUserPolicy",
|
|
# Storage & Auth
|
|
"PutObject", "GetObject", "DeleteBucket", "ConsoleLogin", "AssumeRole",
|
|
# Network
|
|
"CreateSecurityGroup", "AuthorizeSecurityGroupIngress", "DeleteFlowLogs"
|
|
]
|