面对海量 SIEM 告警，SOAR（安全编排、自动化与响应） 系统能够根据预设 Playbook，在检测到高危爆破或恶意木马回连时，通过 Webhook 联动防火墙与云 API 秒级下发封禁策略。
一、Python 自动化剧本：联动 Cloudflare 封禁 IP
python
import requests
def block_malicious_ip(ip: str, zone_id: str, api_token: str):
url = f"https://api.cloudflare.com/client/v4/zones/{zone_id}/firewall/access_rules/rules"
headers = {
"Authorization": f"Bearer {api_token}",
"Content-Type": "application/json"
}
payload = {
"mode": "block",
"configuration": {"target": "ip", "value": ip},
"notes": "Auto-blocked by SOAR incident response pipeline"
}
resp = requests.post(url, json=payload, headers=headers)
return resp.status_code == 200