Zero-Day Incident Containment Architect

Generates tactical containment strategies and mitigation playbooks for zero-day vulnerabilities.

View Source YAML

---
name: Zero-Day Incident Containment Architect
version: 1.0.0
description: Generates tactical containment strategies and mitigation playbooks for zero-day vulnerabilities.
authors:
- Jules
metadata:
  domain: technical
  complexity: high
  tags:
  - security
  - incident-response
  - zero-day
  - architecture
  - containment
  requires_context: true
variables:
- name: vulnerability_context
  description: Technical details of the zero-day vulnerability, affected systems, and active exploit indicators.
  required: true
model: gpt-4o
modelParameters:
  temperature: 0.1
messages:
- role: system
  content: "You are the Principal Security Architect and Lead Incident Responder for an enterprise SOC. Your task is to generate a rigorous, tactical containment strategy and mitigation playbook for an actively exploited zero-day vulnerability.\n\nAnalyze the provided vulnerability context and deliver a structured response that includes:\n1. Immediate Containment Actions (isolation, network blocking, kill switches).\n2. Tactical Mitigation Strategies (configuration changes, compensating controls).\n3. Forensic Preservation Directives (RAM, disk, network captures).\n4. Threat Intelligence Requirements (IoCs, hunting heuristics).\n\nDo NOT propose 'patching' as a primary immediate solution, as this is a zero-day without an official fix. Focus exclusively on defense-in-depth, isolation, and compensating controls. Output must be actionable, precise, and structured."
- role: user
  content: "Analyze the following zero-day vulnerability context and generate the containment playbook:\n\n<vulnerability_context>\n{{vulnerability_context}}\n</vulnerability_context>\n\nOutput format:\n\n# Zero-Day Containment Strategy\n\n## Immediate Containment Actions\n- [Action 1]\n- [Action 2]\n\n## Tactical Mitigation Strategies\n- [Mitigation 1]\n- [Mitigation 2]\n\n## Forensic Preservation Directives\n- [Directive 1]\n- [Directive 2]\n\n## Threat Intelligence Requirements\n- [Requirement 1]\n- [Requirement 2]"
testData:
- input:
    vulnerability_context: "Critical unauthenticated RCE in edge VPN appliance (Firmware v9.0+). Exploitation observed via crafted POST requests to `/api/auth/login`. Payloads spawn reverse shells on port 4444. No vendor patch available. Threat actors appear to be APT-affiliated, dropping memory-resident backdoors."
  expected: "Contains network isolation steps, WAF rules for blocking crafted POSTs, memory capture directives, and reverse shell hunting heuristics."
- input:
    vulnerability_context: "Zero-click LPE via malicious font rendering in a widely used endpoint OS. Exploit triggered upon rendering preview thumbnails in the file explorer. Drops a highly privileged driver. Attacks targeting financial sector executives."
  expected: "Contains steps to disable the preview pane/font rendering service, isolate affected endpoints, memory acquisition of the malicious driver, and behavioral monitoring for suspicious process injections."
evaluators:
- name: Containment Header
  regex:
    pattern: "(?m)^## Immediate Containment Actions"
- name: Mitigation Header
  regex:
    pattern: "(?m)^## Tactical Mitigation Strategies"
- name: Forensic Header
  regex:
    pattern: "(?m)^## Forensic Preservation Directives"
- name: Threat Intel Header
  regex:
    pattern: "(?m)^## Threat Intelligence Requirements"
- name: No Patching as Immediate
  regex:
    pattern: "(?i)(?<!no )patching(?! is not)"
    match: false