feat(dlp-phase1): add policy-based incident pipeline and capability gap analysis

2026-04-25 16:11:05 +03:00
parent 016a323afc
commit c3a49e658c
13 changed files with 473 additions and 10 deletions
@@ -0,0 +1,58 @@
+{
+  "version": 1,
+  "defaults": {
+    "enabled": true,
+    "cooldownSeconds": 300,
+    "action": "log",
+    "severity": "low"
+  },
+  "rules": [
+    {
+      "id": "personal-web-during-workhours",
+      "enabled": true,
+      "cooldownSeconds": 600,
+      "action": "alert",
+      "severity": "medium",
+      "message": "Личные ресурсы в рабочее время",
+      "when": {
+        "categoryGroups": ["personal"],
+        "hourFrom": 9,
+        "hourTo": 19
+      }
+    },
+    {
+      "id": "high-risk-cloud-storage",
+      "enabled": true,
+      "cooldownSeconds": 900,
+      "action": "alert",
+      "severity": "high",
+      "message": "Подозрительный доступ к облачному хранилищу",
+      "when": {
+        "domains": [
+          "dropbox.com",
+          "drive.google.com",
+          "mega.nz",
+          "onedrive.live.com",
+          "disk.yandex.ru"
+        ]
+      }
+    },
+    {
+      "id": "anonymizer-and-vpn-web",
+      "enabled": true,
+      "cooldownSeconds": 900,
+      "action": "alert",
+      "severity": "high",
+      "message": "Использование веб-анонимайзеров / VPN-сервисов",
+      "when": {
+        "domains": [
+          "hidemy.name",
+          "2ip.ru",
+          "whoer.net",
+          "protonvpn.com",
+          "nordvpn.com"
+        ]
+      }
+    }
+  ]
+}