安全运营中心（SOC）部署

部署 4 个代理：collector、analyzer、enforcer 和 dashboard。

角色说明

部署流程

步骤 1： 向用户询问所选角色及前缀（prefix）。

步骤 2： 安装对应技能：

# collector：
clawhub install pilot-event-log pilot-audit-log pilot-stream-data pilot-cron
# analyzer：
clawhub install pilot-event-filter pilot-event-replay pilot-alert pilot-priority-queue
# enforcer：
clawhub install pilot-blocklist pilot-quarantine pilot-webhook-bridge pilot-audit-log
# dashboard：
clawhub install pilot-metrics pilot-slack-bridge pilot-network-map pilot-mesh-status

步骤 3： 设置主机名，并将配置清单写入 ~/.pilot/setups/security-operations-center.json。

步骤 4： 与相邻代理执行握手（handshake）。

各角色的清单模板

collector

{
  "setup": "security-operations-center", "role": "collector", "role_name": "Log Collector",
  "hostname": "-collector",
  "skills": {
    "pilot-event-log": "Aggregate security events from all nodes.",
    "pilot-audit-log": "Maintain tamper-evident event log.",
    "pilot-stream-data": "Stream events to analyzer in real time.",
    "pilot-cron": "Schedule periodic log sweeps."
  },
  "data_flows": [{ "direction": "send", "peer": "-analyzer", "port": 1002, "topic": "security-event", "description": "Raw security events" }],
  "handshakes_needed": ["-analyzer"]
}

analyzer

{
  "setup": "security-operations-center", "role": "analyzer", "role_name": "Threat Analyzer",
  "hostname": "-analyzer",
  "skills": {
    "pilot-event-filter": "Filter and correlate events, detect patterns.",
    "pilot-event-replay": "Replay past events for forensic investigation.",
    "pilot-alert": "Emit classified threat alerts.",
    "pilot-priority-queue": "Prioritize threats by severity."
  },
  "data_flows": [
    { "direction": "receive", "peer": "-collector", "port": 1002, "topic": "security-event", "description": "Raw events" },
    { "direction": "send", "peer": "-enforcer", "port": 1002, "topic": "threat-verdict", "description": "Threat verdicts" },
    { "direction": "send", "peer": "-dashboard", "port": 1002, "topic": "threat-alert", "description": "Classified threats" }
  ],
  "handshakes_needed": ["-collector", "-enforcer", "-dashboard"]
}

enforcer

{
  "setup": "security-operations-center", "role": "enforcer", "role_name": "Threat Enforcer",
  "hostname": "-enforcer",
  "skills": {
    "pilot-blocklist": "Add malicious IPs/agents to deny list.",
    "pilot-quarantine": "Isolate compromised agents.",
    "pilot-webhook-bridge": "Trigger incident webhooks.",
    "pilot-audit-log": "Log all enforcement actions."
  },
  "data_flows": [
    { "direction": "receive", "peer": "-analyzer", "port": 1002, "topic": "threat-verdict", "description": "Threat verdicts" },
    { "direction": "send", "peer": "-dashboard", "port": 1002, "topic": "enforcement-action", "description": "Actions taken" }
  ],
  "handshakes_needed": ["-analyzer", "-dashboard"]
}

dashboard

{
  "setup": "security-operations-center", "role": "dashboard", "role_name": "SOC Dashboard",
  "hostname": "-dashboard",
  "skills": {
    "pilot-metrics": "Display threat counts, response times.",
    "pilot-slack-bridge": "Send security summaries to Slack.",
    "pilot-network-map": "Visualize network topology and threats.",
    "pilot-mesh-status": "Show peer connectivity and encryption status."
  },
  "data_flows": [
    { "direction": "receive", "peer": "-analyzer", "port": 1002, "topic": "threat-alert", "description": "Classified threats" },
    { "direction": "receive", "peer": "-enforcer", "port": 1002, "topic": "enforcement-action", "description": "Actions taken" }
  ],
  "handshakes_needed": ["-analyzer", "-enforcer"]
}

数据流向

• collector → analyzer：原始安全事件（端口 1002）
• analyzer → enforcer：威胁判定结果（端口 1002）
• analyzer → dashboard：已分类威胁（端口 1002）
• enforcer → dashboard：执行动作（端口 1002）

工作流示例

# 在 collector 上执行：
pilotctl --json publish -analyzer security-event '{"type":"port_scan","source":"203.0.113.42","ports":1024}'
# 在 analyzer 上执行：
pilotctl --json publish -enforcer threat-verdict '{"source":"203.0.113.42","severity":"high","action":"block"}'
# 在 enforcer 上执行：
pilotctl --json publish -dashboard enforcement-action '{"source":"203.0.113.42","action":"blocked"}'

依赖项

需具备 pilot-protocol 技能、pilotctl 可执行文件、clawhub 可执行文件，以及一个正在运行的守护进程（daemon）。