{
    "id": "playbook--brute-force",
    "name": "Brute Force Response",
    "version": "2.0",
    "mitre": "TA0006/T1110",
    "trigger": {
        "event_type": "multiple_failed_logins",
        "severity": ["medium", "high", "critical"],
        "threshold": "5+ failed logins from same IP in 60 seconds"
    },
    "steps": [
        {
            "id": "step-1",
            "name": "Collect evidence from auth.log",
            "action": "exec",
            "command": "grep 'Failed password' /var/log/auth.log 2>/dev/null | tail -100 | awk '{print $11}' | sort | uniq -c | sort -rn",
            "output_var": "$$attacker_ips$$",
            "on_failure": "step-1b"
        },
        {
            "id": "step-1b",
            "name": "Collect evidence (fallback — journalctl)",
            "action": "exec",
            "command": "journalctl _SYSTEMD_UNIT=sshd.service 2>/dev/null | grep 'Failed' | tail -100 | awk '{print $11}' | sort | uniq -c | sort -rn",
            "output_var": "$$attacker_ips$$",
            "on_failure": "step-3"
        },
        {
            "id": "step-2",
            "name": "Enrich attacker IPs",
            "action": "exec",
            "command": "for ip in $$top_3_ips$$; do curl -s --max-time 5 'https://api.abuseipdb.com/api/v2/check?ipAddress='$ip -H 'Key: $ABUSEIPDB_KEY' -H 'Accept: application/json' 2>/dev/null | jq -r '.data | \"\\(.ipAddress) score=\\(.abuseConfidenceScore) country=\\(.countryCode)\"' 2>/dev/null || echo \"$ip enrichment-skipped\"; done",
            "depends_on": "step-1",
            "on_failure": "step-3"
        },
        {
            "id": "step-3",
            "name": "Block via iptables",
            "action": "exec",
            "command": "for ip in $$top_3_ips$$; do sudo iptables -A INPUT -s $ip -j DROP && sudo iptables -A OUTPUT -d $ip -j DROP && echo \"BLOCKED iptables: $ip\"; done",
            "depends_on": "step-1",
            "on_failure": "step-3b"
        },
        {
            "id": "step-3b",
            "name": "Block via nftables (fallback)",
            "action": "exec",
            "command": "for ip in $$top_3_ips$$; do sudo nft add rule inet filter input ip saddr $ip drop && echo \"BLOCKED nftables: $ip\"; done",
            "on_failure": "step-3c"
        },
        {
            "id": "step-3c",
            "name": "Block via fail2ban/ufw (last resort)",
            "action": "exec",
            "command": "for ip in $$top_3_ips$$; do sudo fail2ban-client set sshd banip $ip 2>/dev/null || sudo ufw deny from $ip to any 2>/dev/null && echo \"BLOCKED fallback: $ip\"; done"
        },
        {
            "id": "step-4",
            "name": "Verify block effective",
            "action": "exec",
            "command": "sudo iptables -L INPUT -n | grep DROP; sudo nft list ruleset 2>/dev/null | grep drop",
            "depends_on": "step-3"
        },
        {
            "id": "step-5",
            "name": "Harden SSH — disable password auth",
            "action": "exec",
            "command": "sudo sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config && sudo systemctl reload sshd && echo 'SSH password auth disabled'",
            "depends_on": "step-4"
        },
        {
            "id": "step-6",
            "name": "Generate incident report",
            "action": "write",
            "template": "incident_report",
            "depends_on": "step-4"
        }
    ],
    "learning": {
        "on_success": "SIEMPRE: Bloquear IPs inmediatamente + deshabilitar password auth en SSH",
        "on_failure": "NUNCA: Depender de un solo método — cadena iptables → nftables → fail2ban/ufw"
    }
}