{
  "id": "playbook--data-exfiltration",
  "name": "Data Exfiltration Response",
  "version": "1.0",
  "mitre": "TA0010/T1048",
  "trigger": {
    "event_type": "large_outbound_transfer",
    "severity": ["high", "critical"]
  },
  "steps": [
    {
      "id": "step-1",
      "name": "Collect evidence",
      "action": "exec",
      "command": "ss -tnp state established | grep $$target_ip$$; nethogs -t -c 2"
    },
    {
      "id": "step-2",
      "name": "Contain threat",
      "action": "exec",
      "command": "sudo iptables -A OUTPUT -d $$target_ip$$ -j DROP",
      "depends_on": "step-1"
    },
    {
      "id": "step-3",
      "name": "Generate report",
      "action": "write",
      "template": "incident_report",
      "depends_on": "step-2"
    }
  ]
}