--- name: dnr-respond description: Incident response workup for a lead in hand — an alert, an IOC, or a /dnr-hunt finding. Scopes the lead across the logs, verdicts whether the attack succeeded, quantifies blast radius, confirms root cause in source with a local PoC, and writes a proposed (never executed) containment/remediation/recovery plan. Use when asked to "respond to this alert", "work this incident", "how bad is this", or "run dnr-respond". /dnr-hunt is the no-alert entry to the same track. argument-hint: " [--logs dir] [--repo path] [--fresh]" allowed-tools: - Read - Glob - Grep - Write - Bash(rg:*) - Bash(grep:*) - Bash(awk:*) - Bash(sed:*) - Bash(sort:*) - Bash(uniq:*) - Bash(cut:*) - Bash(head:*) - Bash(tail:*) - Bash(wc:*) - Bash(ls:*) - Bash(du:*) - Bash(file:*) - Bash(jq:*) - Bash(python3:*) - Bash(curl:*) - Bash(kill:*) --- # dnr-respond Lead-in-hand incident response: take one concrete starting point and answer the four questions an incident commander needs, in order — **what happened, did it succeed, how far did it go, and what do we do about it.** The output is a verdict, a quantified blast radius, a root cause proven in source, and a response plan that is *proposed, never executed*. Invoke with `/dnr-respond [--logs dir] [--repo path] [--fresh]`. **The lead (`$1`) can be:** - an incident id from the hunt's `INCIDENTS.json` (e.g. `INC-2`) — the `/dnr-hunt` handoff - an alert pasted from an alert queue (JSON line or prose) - an IOC: an IP, an account name, a route, a session identifier - free text ("a customer says their address was quoted in a phishing email") **Other arguments:** - `--logs` = logs directory or dnr target directory (same resolution as `/dnr-hunt`; defaults to `targets/dnrcanary` if it exists, else cwd). - `--repo` = application source (defaults to the target's `app/`). - `--fresh` = ignore any checkpoint in the run dir's `.dnr-respond-state/` and mint a new run dir. ## Hard rules (shared with /dnr-hunt — the track's contract) 1. **Log evidence alone never confirms a vulnerability.** `confirmed_exploited` requires log evidence + the flaw in source + a PoC fired locally this session. Otherwise the ceiling is `suspected`. 2. **Query, don't read.** Never `Read` or `cat` a log file; `wc`/`head`/ `tail` to profile, `grep`/`awk`/`sort`/`uniq`/`python3` to interrogate. Small files (alert queues, error logs under ~200 lines) may be read whole. 3. **Propose, never execute.** No blocking, disabling, rotating, or config changes — in any environment, including the demo app. The plan names actions; humans execute them. 4. **Local only.** PoCs fire at `127.0.0.1` against an instance you started. Never touch a remote host. 5. **Every number is a query result.** "How many records" and "how many customers" get answered by pipelines run this session, never estimated. ## Run directory and checkpointing **First action — establish the run directory**, the same way `/dnr-hunt` does, but as a *consumer*. Let `TARGET` be the basename of the resolved `--logs`/target path (default `targets/dnrcanary`) and `SCOPE` that path. - **Lead is `INC-n`** (the `/dnr-hunt` handoff, or a second lead from a hunt you already started responding to): work the response into the investigation that incident lives in. `{RUN}` is the newest `results/TARGET//` directory that contains an `INCIDENTS.json` — find it with Bash, e.g. `ls -1d results/TARGET/*/ | sort -r | while read d; do [ -f "$d/INCIDENTS.json" ] && echo "$d" && break; done`. Do **not** call `rundir` for an `INC-n` lead — `rundir` mints a fresh empty dir once a prior `/dnr-respond` in that dir has completed, which would strand the incident's `INCIDENTS.json` in the old dir. Only if no run dir holds an `INCIDENTS.json` (you were handed `INC-n` but never ran the hunt) fall through to the `rundir` line below. - **Any other lead** (alert, IOC, free text): Bash `python3 .claude/skills/_lib/checkpoint.py rundir results/TARGET --state .dnr-respond-state --scope "SCOPE"` (append `--fresh` if it's in `$ARGUMENTS`). This adopts the newest run dir for the target if one exists, else mints a fresh `results/TARGET//`. That path is `{RUN}`; substitute the literal path everywhere below, and double-quote it (and `SCOPE`) in Bash. Checkpoint mechanics are identical to `/dnr-hunt`, state dir `{RUN}/.dnr-respond-state/`, phases 0–4. When `{RUN}` already holds a **completed** `.dnr-respond-state` from an earlier lead, `load` reports `complete` and the rules below reset it cleanly — a second lead enriches the same `INCIDENTS.json` and writes its own `RESPONSE-.md`. On start: `python3 .claude/skills/_lib/checkpoint.py load {RUN}/.dnr-respond-state` — absent/complete/`--fresh` → `reset` and start at Phase 0; running with `phase_done == N` → read `phase0.json`…`phaseN.json`, resume at N+1. After each phase: Write payload to `{RUN}/.dnr-respond-state/_chunk.tmp`, then `checkpoint.py save {RUN}/.dnr-respond-state --from {RUN}/.dnr-respond-state/_chunk.tmp`. Never write `progress.json` directly; never pass payload via heredoc/stdin. After outputs: `checkpoint.py done {RUN}/.dnr-respond-state 4`. ## Phase 0 — Parse the lead, locate inputs 1. Resolve `--logs` (dnr target config or bare directory) and inventory log files (`du`, `wc -l`, `head -2` each — identify formats and field positions). The corpus is expected to exist already — the target README covers generating it. 2. Parse the lead into starting entities: - `INC-n` → read that entry from `{RUN}/INCIDENTS.json` (the run dir adopted above); its IPs, accounts, routes, and timeline rows are the seed set. - alert line → source IP, rule, path, timestamp. - IOC → the entity itself. - free text → extract the observables (who reported, what data, when); the seed set may start as just a route or a table name. 3. State the working question in one sentence (e.g. "did 203.0.113.66's activity against /login succeed, and if not, what did?"). Everything in Phase 1 serves that question. Checkpoint `phase0.json`: `{"lead": ..., "lead_type": ..., "entities": {"ips": [], "accounts": [], "routes": [], "windows": []}, "question": ..., "logs_dir": ..., "repo": ..., "files": [...]}` ## Phase 1 — Scope: pull everything the entities touched For each seed entity, extract its complete activity, then expand one ring: - **Per IP:** every request — time-ordered, with route, status, size, UA, and authenticated user. Summarize phases of behavior, don't paste hundreds of lines. - **Per account:** every login (from which IPs), every authenticated request. Compare against that account's historical pattern in the same corpus — new IP, new UA, new volume, new hours are all signal. (A new IP *alone* is baseline noise — users roam; combine it with volume, cadence, or what the session did next before treating it as a lead.) - **Per route:** who else hit it the same way in the window? One attacker found via an alert may not be the only one. - **Ring expansion (once):** entities discovered above join the set — the account an IP logged into, the second IP that touched the same account, the route a session pivoted to. Expand once, deliberately; /dnr-hunt's open-ended loop is the tool when scope keeps growing. - **Correlate the error log and alert queue** rows for all entities into one timeline. Checkpoint `phase1.json`: `{"activity": [{"entity", "summary", "first_seen", "last_seen", "requests", "key_lines": [...]}], "expanded_entities": [...], "timeline": [...]}` ## Phase 2 — Verdict and blast radius Answer the working question with evidence on both sides: - **Did it succeed?** Status codes alone don't answer this — a 401 wall says no; 200s with anomalous sizes, error-then-success progressions, and data-shaped responses say yes. State the verdict and the discriminating evidence. - **Blast radius, quantified.** What data was reached: which routes/tables, how many records, over what time span, belonging to how many distinct users/customers. Each figure comes from a pipeline (count the exfil-page sizes, count the distinct ids walked, join walked ids to owners via the app's own data if available locally — running the target's deterministic `seed_command` early, before Phase 3, is fine). - **Containment status check (read-only).** Is the activity ongoing at the end of the corpus window, or did it stop? When was the last attacker action? - If the verdict is "did not succeed", the workup doesn't end — say what the attacker was *trying* and why it failed; that feeds the plan's hardening section and the `ruled_out` record. Checkpoint `phase2.json`: `{"verdict": ..., "succeeded": bool, "discriminators": [...], "blast_radius": {"data": ..., "records": N, "distinct_victims": N, "window": ...}, "ongoing": bool, "last_activity": ...}` ## Phase 3 — Root cause and PoC Same bar as `/dnr-hunt` Phase 3–4: 1. Read the implicated handler(s) in `--repo`; name the flaw (or the defense) at file/function precision; check sibling routes for the same flaw class. 2. Seed and start the app locally per target config: `seed_command` / `app_command` are target-relative — run them with the target directory as cwd; launch in the background via a single command that prints the PID (the same `python3 -c "...subprocess.Popen..."` pattern /dnr-hunt Phase 4 shows, with the port override env var if the default port is busy). Fire the **minimal** PoC, record command + response excerpt, fire the negative PoC against defended routes, then `kill ` (never by port or pattern). 3. No runnable app → verdict ceiling is `suspected`, stated explicitly. Checkpoint `phase3.json`: `{"root_cause": {"file", "function", "mechanism"}, "poc": {"command", "status", "response_excerpt"}, "negative_poc": {...}, "siblings_checked": [...]}` ## Phase 4 — The response plan (PROPOSED, NEVER EXECUTED) and outputs Write the plan to `{RUN}/RESPONSE.md` — or `{RUN}/RESPONSE-.md` (e.g. `RESPONSE-INC-2.md`) if a `RESPONSE.md` from a different lead already exists in the run dir; never silently overwrite another incident's plan. Sections, every action carrying **what / why / risk-if-wrong**: 1. **Verdict & summary** — three sentences: what happened, did it succeed, how far it went. 2. **Timeline** — the merged entity timeline from Phase 1. 3. **Containment (proposed)** — block/deny candidates (IPs, sessions, tokens), accounts to suspend, routes to rate-limit or disable. For each: the evidence line that justifies it and what breaks if the call is wrong (e.g. blocking a NAT IP locks out legitimate users behind it). 4. **Eradication & remediation (proposed)** — the code fix, described at file/function level, handed off as a `/triage`-compatible vuln entry; interim mitigations if the fix will take time. 5. **Recovery (proposed)** — exactly which credentials rotate (the queried list, not "all users"), which customers get notified (the distinct-victim list from Phase 2), what monitoring confirms the attacker is out. 6. **Detection engineering (proposed)** — the rules that would have caught this earlier, derived from what you actually used to find it: the discriminating queries from Phase 2 turned into alert logic (e.g. error-rate per source on a route; sequential-id access cadence; account-from-new-IP at volume). Note which existing alerts fired, which were noise, and what that says about the queue. 7. **Open questions** — what this corpus cannot answer (earlier history, other log sources, whether stolen data was used elsewhere). Then update `{RUN}/INCIDENTS.json` (same schema as `/dnr-hunt`; create it if absent): add or enrich this incident — verdict, quantified impact, root cause, PoC, timeline. Extra keys are fine — graders match on content, not structure. Negative outcomes go to `ruled_out`. Mark complete (`checkpoint.py done {RUN}/.dnr-respond-state 4`) and point the user onward (substitute the literal `{RUN}` path): - for the fix, from inside `{RUN}`: `/triage INCIDENTS.json --repo ` then `/patch TRIAGE.json --repo ` — both write to the directory they're invoked from, so running them there lands the verdicts and patches beside the incidents - on a dnr target: `python /grade.py {RUN}/INCIDENTS.json` to self-score (the user runs this) - a human reviews and executes (or rejects) each proposed action; nothing in RESPONSE.md has been done ## Customizing beyond the demo - Feed it your real alert queue one alert at a time — the lead parser takes any JSON or prose alert; the method doesn't change. - Auth logs, CDN/WAF exports, and EDR threat events slot into Phase 1 as additional per-entity activity sources; keep the single merged timeline. - The Phase 4 plan template is the part most worth adapting to your org: map containment to your actual controls (WAF rules, IdP session revocation, feature flags) — still as proposals routed to the owning team, never as actions the agent takes.