ai-soc-agent

CRITICAL: The `RulesEngine` (`src/mcp/rules_engine.py`) uses `eval()` to process rule `trigger` and `action` strings. If an attacker can manipulate these rule definitions (e.g., through compromised configuration files or an unauthenticated API that allows rule modification), this allows for arbitrary code execution on the server. This is a severe vulnerability. Additionally, the HTTP clients (e.g., `iris_http.py`, `elastic_http.py`) expose a `verify_ssl` parameter which defaults to `True` but is explicitly set to `False` in the `config.json` example and can be configured as `False`. Running with `verify_ssl=False` in production makes the application vulnerable to Man-in-the-Middle (MITM) attacks. The system relies heavily on API keys/tokens for numerous integrations (SIEM, EDR, Case Management, CTI, Engineering). Compromise of these credentials could lead to significant security breaches or unauthorized actions in integrated security tools. Secure management of these secrets is paramount.