威胁情报系统部署

部署 4 个智能体：collector、enricher、analyzer 和 distributor。

角色说明

部署流程

步骤 1： 向用户询问该智能体应承担的角色以及所用前缀（）。

步骤 2： 安装对应角色所需的技能：

# collector 角色：
clawhub install pilot-stream-data pilot-cron pilot-archive
# enricher 角色：
clawhub install pilot-dataset pilot-task-router pilot-event-filter
# analyzer 角色：
clawhub install pilot-metrics pilot-consensus pilot-alert
# distributor 角色：
clawhub install pilot-webhook-bridge pilot-announce pilot-audit-log

步骤 3： 设置主机名，并将配置清单写入 ~/.pilot/setups/threat-intelligence.json。

步骤 4： 提示用户与其角色所需通信的对等节点（peers）发起握手（handshake）。

各角色对应的清单模板

collector

{
  "setup": "threat-intelligence", "role": "collector", "role_name": "Intel Collector",
  "hostname": "-collector",
  "skills": {
    "pilot-stream-data": "从 OSINT 和蜜罐中实时采集威胁情报源数据。",
    "pilot-cron": "定时扫描 CVE 数据库和暗网资源。",
    "pilot-archive": "存储原始指标历史记录，用于回溯分析。"
  },
  "data_flows": [{ "direction": "send", "peer": "-enricher", "port": 1002, "topic": "raw-ioc", "description": "来自威胁情报源的标准化 IOC" }],
  "handshakes_needed": ["-enricher"]
}

enricher

{
  "setup": "threat-intelligence", "role": "enricher", "role_name": "Threat Enricher",
  "hostname": "-enricher",
  "skills": {
    "pilot-dataset": "将 IOC 与已知威胁数据库进行交叉比对。",
    "pilot-task-router": "将增强任务路由至专用查询服务。",
    "pilot-event-filter": "在分析前过滤低置信度指标。"
  },
  "data_flows": [
    { "direction": "receive", "peer": "-collector", "port": 1002, "topic": "raw-ioc", "description": "待增强的原始 IOC" },
    { "direction": "send", "peer": "-analyzer", "port": 1002, "topic": "enriched-ioc", "description": "附带 WHOIS、GeoIP 及 MITRE 上下文信息的 IOC" }
  ],
  "handshakes_needed": ["-collector", "-analyzer"]
}

analyzer

{
  "setup": "threat-intelligence", "role": "analyzer", "role_name": "Threat Analyzer",
  "hostname": "-analyzer",
  "skills": {
    "pilot-metrics": "跟踪威胁数量、严重性分布及响应时间。",
    "pilot-consensus": "融合多源研判结果，生成高置信度评分。",
    "pilot-alert": "发出需立即响应的关键威胁告警。"
  },
  "data_flows": [
    { "direction": "receive", "peer": "-enricher", "port": 1002, "topic": "enriched-ioc", "description": "待分析的增强型 IOC" },
    { "direction": "send", "peer": "-distributor", "port": 1002, "topic": "threat-verdict", "description": "含攻击活动归属信息的评分研判结果" }
  ],
  "handshakes_needed": ["-enricher", "-distributor"]
}

distributor

{
  "setup": "threat-intelligence", "role": "distributor", "role_name": "Intel Distributor",
  "hostname": "-distributor",
  "skills": {
    "pilot-webhook-bridge": "向防火墙、IDS 和 SIEM 推送 IOC 更新。",
    "pilot-announce": "向已订阅的消费者广播威胁通告。",
    "pilot-audit-log": "记录所有已发布情报及其分发时间戳。"
  },
  "data_flows": [
    { "direction": "receive", "peer": "-analyzer", "port": 1002, "topic": "threat-verdict", "description": "待分发的威胁研判结果" },
    { "direction": "send", "peer": "external", "port": 443, "topic": "threat-feed", "description": "推送至安全基础设施的 STIX/TAXII 威胁情报源" }
  ],
  "handshakes_needed": ["-analyzer"]
}

数据流向

• collector -> enricher：来自威胁情报源的原始 IOC（端口 1002）
• enricher -> analyzer：附带上下文与置信度评分的增强型 IOC（端口 1002）
• analyzer -> distributor：含严重性评级与攻击活动归属信息的威胁研判结果（端口 1002）
• distributor -> external：推送至安全基础设施的已发布威胁情报源（端口 443）

工作流示例

# 在 collector 上 —— 转发原始 IOC：
pilotctl --json publish -enricher raw-ioc '{"type":"ip","value":"198.51.100.23","source":"honeypot-east","tags":["c2","cobalt-strike"]}'
# 在 enricher 上 —— 转发增强型 IOC：
pilotctl --json publish -analyzer enriched-ioc '{"type":"ip","value":"198.51.100.23","whois":{"asn":"AS62904","country":"RU"},"mitre":["T1071.001"],"confidence":0.87}'
# 在 analyzer 上 —— 发送研判结果：
pilotctl --json publish -distributor threat-verdict '{"ioc":"198.51.100.23","severity":"critical","campaign":"APT-THUNDER-BEAR","action":"block"}'

依赖项

需安装 pilot-protocol 技能、pilotctl 二进制程序、clawhub 二进制程序，并确保后台守护进程（daemon）正在运行。