Ansible for SIEM and SOC: Automate Security Operations, Incident Response, and Compliance

---
- name: Configure centralized logging
  hosts: all
  become: true

  vars:
    siem_server: "siem.company.com"
    siem_port: 514
    siem_protocol: tcp

  tasks:
    - name: Install rsyslog
      ansible.builtin.package:
        name: rsyslog
        state: present

    - name: Configure remote syslog forwarding
      ansible.builtin.template:
        src: rsyslog-forward.conf.j2
        dest: /etc/rsyslog.d/50-siem-forward.conf
        mode: '0644'
      notify: restart rsyslog

    - name: Ensure audit logging enabled
      ansible.builtin.package:
        name: auditd
        state: present

    - name: Deploy audit rules for security monitoring
      ansible.builtin.copy:
        content: |
          # Monitor authentication files
          -w /etc/passwd -p wa -k identity
          -w /etc/shadow -p wa -k identity
          -w /etc/group -p wa -k identity
          -w /etc/gshadow -p wa -k identity

          # Monitor sudo usage
          -w /etc/sudoers -p wa -k sudo_changes
          -w /etc/sudoers.d/ -p wa -k sudo_changes

          # Monitor SSH configuration
          -w /etc/ssh/sshd_config -p wa -k sshd_config

          # Monitor cron
          -w /etc/crontab -p wa -k cron
          -w /etc/cron.d/ -p wa -k cron

          # Monitor login/logout
          -w /var/log/lastlog -p wa -k logins
          -w /var/log/faillog -p wa -k logins

          # Monitor privilege escalation
          -a always,exit -F arch=b64 -S execve -C uid!=euid -k escalation
        dest: /etc/audit/rules.d/security.rules
        mode: '0640'
      notify: restart auditd

  handlers:
    - name: restart rsyslog
      ansible.builtin.systemd:
        name: rsyslog
        state: restarted

    - name: restart auditd
      ansible.builtin.service:
        name: auditd
        state: restarted

---
- name: Deploy Splunk Universal Forwarder
  hosts: all
  become: true

  vars:
    splunk_server: "splunk-indexer.company.com"
    splunk_port: 9997
    splunk_forwarder_url: "https://download.splunk.com/products/universalforwarder/releases/9.3.0/linux/splunkforwarder-9.3.0-linux-x86_64.tgz"

  tasks:
    - name: Download Splunk UF
      ansible.builtin.get_url:
        url: "{{ splunk_forwarder_url }}"
        dest: /tmp/splunkforwarder.tgz

    - name: Extract Splunk UF
      ansible.builtin.unarchive:
        src: /tmp/splunkforwarder.tgz
        dest: /opt
        remote_src: true
        creates: /opt/splunkforwarder

    - name: Configure forwarding
      ansible.builtin.template:
        src: splunk-outputs.conf.j2
        dest: /opt/splunkforwarder/etc/system/local/outputs.conf
      notify: restart splunk-forwarder

    - name: Configure inputs
      ansible.builtin.copy:
        content: |
          [monitor:///var/log/auth.log]
          sourcetype = linux_secure
          index = security

          [monitor:///var/log/audit/audit.log]
          sourcetype = linux_audit
          index = security

          [monitor:///var/log/syslog]
          sourcetype = syslog
          index = main
        dest: /opt/splunkforwarder/etc/system/local/inputs.conf
      notify: restart splunk-forwarder

    - name: Start Splunk Forwarder
      ansible.builtin.command:
        cmd: /opt/splunkforwarder/bin/splunk start --accept-license --no-prompt
        creates: /opt/splunkforwarder/var/run/splunk/splunkd.pid

  handlers:
    - name: restart splunk-forwarder
      ansible.builtin.command:
        cmd: /opt/splunkforwarder/bin/splunk restart

---
- name: Deploy Elastic Agent for SIEM
  hosts: all
  become: true

  vars:
    fleet_url: "https://fleet.company.com:8220"
    enrollment_token: "{{ vault_elastic_token }}"

  tasks:
    - name: Download Elastic Agent
      ansible.builtin.get_url:
        url: "https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.16.0-linux-x86_64.tar.gz"
        dest: /tmp/elastic-agent.tar.gz

    - name: Extract agent
      ansible.builtin.unarchive:
        src: /tmp/elastic-agent.tar.gz
        dest: /opt
        remote_src: true

    - name: Enroll agent with Fleet
      ansible.builtin.command:
        cmd: >
          /opt/elastic-agent-8.16.0-linux-x86_64/elastic-agent install
          --url={{ fleet_url }}
          --enrollment-token={{ enrollment_token }}
          --non-interactive
        creates: /opt/Elastic/Agent/elastic-agent

---
- name: Isolate compromised host
  hosts: "{{ compromised_host }}"
  become: true

  vars:
    soc_server: "10.0.0.5"
    siem_server: "10.0.0.10"
    ticket_id: "{{ incident_ticket }}"

  tasks:
    - name: Capture network connections before isolation
      ansible.builtin.shell: |
        ss -tunap > /root/forensics/connections_{{ ansible_date_time.iso8601 }}.txt
        netstat -rn > /root/forensics/routes_{{ ansible_date_time.iso8601 }}.txt
        ip addr show > /root/forensics/interfaces_{{ ansible_date_time.iso8601 }}.txt
      args:
        creates: /root/forensics

    - name: Create forensics directory
      ansible.builtin.file:
        path: /root/forensics
        state: directory
        mode: '0700'

    - name: Capture running processes
      ansible.builtin.shell: |
        ps auxww > /root/forensics/processes.txt
        lsof -i > /root/forensics/open_files.txt
      changed_when: false

    - name: Capture memory-mapped files for suspicious processes
      ansible.builtin.shell: |
        for pid in $(ps aux | awk '/SUSPECT_PROCESS/ {print $2}'); do
          cat /proc/$pid/maps > /root/forensics/maps_${pid}.txt 2>/dev/null
          ls -la /proc/$pid/fd/ > /root/forensics/fd_${pid}.txt 2>/dev/null
        done
      changed_when: false
      ignore_errors: true

    - name: Block all traffic except SOC and SIEM
      community.general.ufw:
        rule: allow
        from_ip: "{{ item }}"
        comment: "Incident {{ ticket_id }} - allowed during isolation"
      loop:
        - "{{ soc_server }}"
        - "{{ siem_server }}"

    - name: Set default deny
      community.general.ufw:
        default: deny
        direction: "{{ item }}"
      loop:
        - incoming
        - outgoing

    - name: Enable firewall
      community.general.ufw:
        state: enabled

    - name: Disable cron to prevent lateral movement
      ansible.builtin.systemd:
        name: cron
        state: stopped
        enabled: false

    - name: Lock all non-root user accounts
      ansible.builtin.shell: |
        for user in $(awk -F: '$3 >= 1000 && $3 != 65534 {print $1}' /etc/passwd); do
          usermod -L "$user"
          echo "Locked: $user" >> /root/forensics/locked_users.txt
        done
      changed_when: true

    - name: Send isolation notification
      ansible.builtin.uri:
        url: "https://hooks.slack.com/services/{{ vault_slack_webhook }}"
        method: POST
        body_format: json
        body:
          text: "🔴 Host {{ inventory_hostname }} isolated for incident {{ ticket_id }}"

---
- name: Hunt for indicators of compromise
  hosts: all
  become: true

  vars:
    ioc_hashes:
      - "e99a18c428cb38d5f260853678922e03"
      - "d41d8cd98f00b204e9800998ecf8427e"
    ioc_ips:
      - "185.220.101.0/24"
      - "45.155.205.0/24"
    suspicious_ports:
      - 4444
      - 5555
      - 8888
      - 1337

  tasks:
    - name: Check for known malicious file hashes
      ansible.builtin.shell: |
        find / -type f -executable -newer /etc/hostname -exec md5sum {} \; 2>/dev/null | head -1000
      register: file_hashes
      changed_when: false
      timeout: 120

    - name: Flag IOC hash matches
      ansible.builtin.set_fact:
        ioc_matches: "{{ file_hashes.stdout_lines | select('search', item) | list }}"
      loop: "{{ ioc_hashes }}"
      register: hash_results

    - name: Check for connections to known bad IPs
      ansible.builtin.shell: |
        ss -tunap | grep -E "{{ ioc_ips | join('|') }}" || true
      register: bad_connections
      changed_when: false

    - name: Check for suspicious listening ports
      ansible.builtin.shell: |
        ss -tlnp | grep -E ":{{ suspicious_ports | join('|:') }}" || true
      register: suspicious_listeners
      changed_when: false

    - name: Check for unauthorized SSH keys
      ansible.builtin.find:
        paths: /home
        patterns: "authorized_keys"
        recurse: true
      register: ssh_keys

    - name: Check for suspicious cron jobs
      ansible.builtin.shell: |
        for user in $(cut -d: -f1 /etc/passwd); do
          crontab -l -u "$user" 2>/dev/null | grep -v "^#" | grep -v "^$"
        done
      register: cron_jobs
      changed_when: false

    - name: Check for rootkits (basic)
      ansible.builtin.shell: |
        # Check for hidden processes
        diff <(ps aux | awk '{print $2}' | sort -n) <(ls /proc | grep -E '^[0-9]+$' | sort -n) || true
        # Check for modified system binaries
        rpm -Va 2>/dev/null | grep -E '^..5' || dpkg --verify 2>/dev/null | grep -v "^$" || true
      register: rootkit_check
      changed_when: false

    - name: Generate hunt report
      ansible.builtin.template:
        src: hunt-report.j2
        dest: "/tmp/hunt_{{ inventory_hostname }}_{{ ansible_date_time.date }}.txt"
      delegate_to: localhost

---
- name: CIS benchmark compliance check
  hosts: all
  become: true

  tasks:
    - name: Check SSH configuration
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        regexp: "{{ item.regexp }}"
        line: "{{ item.line }}"
        state: present
      loop:
        - { regexp: '^PermitRootLogin', line: 'PermitRootLogin no' }
        - { regexp: '^PasswordAuthentication', line: 'PasswordAuthentication no' }
        - { regexp: '^X11Forwarding', line: 'X11Forwarding no' }
        - { regexp: '^MaxAuthTries', line: 'MaxAuthTries 4' }
        - { regexp: '^ClientAliveInterval', line: 'ClientAliveInterval 300' }
        - { regexp: '^ClientAliveCountMax', line: 'ClientAliveCountMax 0' }
        - { regexp: '^LoginGraceTime', line: 'LoginGraceTime 60' }
        - { regexp: '^Protocol', line: 'Protocol 2' }
      notify: restart sshd

    - name: Ensure password expiration
      ansible.builtin.lineinfile:
        path: /etc/login.defs
        regexp: "{{ item.regexp }}"
        line: "{{ item.line }}"
      loop:
        - { regexp: '^PASS_MAX_DAYS', line: 'PASS_MAX_DAYS 90' }
        - { regexp: '^PASS_MIN_DAYS', line: 'PASS_MIN_DAYS 7' }
        - { regexp: '^PASS_WARN_AGE', line: 'PASS_WARN_AGE 14' }

    - name: Ensure core dumps restricted
      ansible.builtin.lineinfile:
        path: /etc/security/limits.conf
        line: "* hard core 0"
        state: present

    - name: Disable USB storage
      ansible.builtin.copy:
        content: "install usb-storage /bin/true"
        dest: /etc/modprobe.d/usb-storage.conf
        mode: '0644'

    - name: Set file permissions on sensitive files
      ansible.builtin.file:
        path: "{{ item.path }}"
        mode: "{{ item.mode }}"
        owner: root
        group: "{{ item.group | default('root') }}"
      loop:
        - { path: /etc/passwd, mode: '0644' }
        - { path: /etc/shadow, mode: '0640', group: shadow }
        - { path: /etc/group, mode: '0644' }
        - { path: /etc/gshadow, mode: '0640', group: shadow }
        - { path: /etc/crontab, mode: '0600' }

  handlers:
    - name: restart sshd
      ansible.builtin.systemd:
        name: sshd
        state: restarted

---
- name: Vulnerability management
  hosts: all
  become: true

  tasks:
    - name: Check for available security updates
      ansible.builtin.apt:
        update_cache: true
        upgrade: "no"
      register: apt_updates
      check_mode: true
      when: ansible_os_family == "Debian"

    - name: Get list of security updates
      ansible.builtin.shell: |
        apt list --upgradable 2>/dev/null | grep -i security
      register: security_updates
      changed_when: false
      when: ansible_os_family == "Debian"

    - name: Apply security patches (maintenance window)
      ansible.builtin.apt:
        upgrade: safe
        update_cache: true
      when:
        - ansible_os_family == "Debian"
        - maintenance_window | default(false)
      notify: check reboot required

    - name: Scan for CVEs in installed packages
      ansible.builtin.shell: |
        if command -v grype &>/dev/null; then
          grype dir:/ --only-fixed -o table 2>/dev/null | head -50
        else
          echo "grype not installed"
        fi
      register: cve_scan
      changed_when: false

  handlers:
    - name: check reboot required
      ansible.builtin.stat:
        path: /var/run/reboot-required
      register: reboot_file

    - name: notify reboot needed
      ansible.builtin.debug:
        msg: "⚠️ {{ inventory_hostname }} requires reboot after security patches"
      when: reboot_file.stat.exists | default(false)

---
- name: Block threat actor across all firewalls
  hosts: firewalls
  
  vars:
    threat_ips:
      - "185.220.101.42"
      - "45.155.205.19"
    ticket_id: "IR-2026-0142"

  tasks:
    - name: Block on Palo Alto
      paloaltonetworks.panos.panos_address_object:
        provider: "{{ panos_provider }}"
        name: "block-{{ item | replace('.', '-') }}"
        value: "{{ item }}"
        description: "Blocked - {{ ticket_id }}"
      loop: "{{ threat_ips }}"
      when: "'paloalto' in group_names"

    - name: Block on Linux firewalls
      community.general.ufw:
        rule: deny
        from_ip: "{{ item }}"
        comment: "Blocked - {{ ticket_id }}"
      loop: "{{ threat_ips }}"
      when: "'linux' in group_names"

    - name: Block on Cisco ASA
      cisco.asa.asa_acls:
        config:
          - afi: ipv4
            acls:
              - name: OUTSIDE_IN
                aces:
                  - grant: deny
                    source:
                      address: "{{ item }}"
                    destination:
                      any: true
        state: merged
      loop: "{{ threat_ips }}"
      when: "'cisco_asa' in group_names"

# AAP job template with survey for dynamic parameters
# SOAR calls AAP API to launch jobs:

# curl -X POST "https://aap.company.com/api/controller/v2/job_templates/42/launch/" \
#   -H "Authorization: Bearer $TOKEN" \
#   -H "Content-Type: application/json" \
#   -d '{
#     "extra_vars": {
#       "compromised_host": "web-03.company.com",
#       "incident_ticket": "IR-2026-0142",
#       "action": "isolate"
#     }
#   }'

---
- name: SOAR-triggered incident response
  hosts: "{{ compromised_host }}"
  become: true

  tasks:
    - name: Isolate host
      ansible.builtin.include_role:
        name: incident_response
        tasks_from: isolate.yml
      when: action == "isolate"

    - name: Collect forensics
      ansible.builtin.include_role:
        name: incident_response
        tasks_from: collect_evidence.yml
      when: action == "forensics"

    - name: Block IOCs
      ansible.builtin.include_role:
        name: incident_response
        tasks_from: block_iocs.yml
      when: action == "block"
      delegate_to: "{{ item }}"
      loop: "{{ groups['firewalls'] }}"

    - name: Restore host
      ansible.builtin.include_role:
        name: incident_response
        tasks_from: restore.yml
      when: action == "restore"