SOAR & Playbook Orchestration Agents
Problem Statement
Session hijacking attacks (e.g., adversary-in-the-middle proxy attacks stealing Okta or Salesforce session cookies) bypass MFA requirements because the attacker uses a pre-authenticated session cookie from a new IP address.
Goal
Implement an agent that detects simultaneous session usage across geographically impossible locations, revokes active session tokens, and forces immediate re-authentication.
Outcome Measurement
- Session Eviction: Compromised sessions terminated within 10 seconds of detection.
- MFA Enforce Rate: 100% of flagged sessions forced to re-authenticate with WebAuthn/FIDO2 keys.
How the Code was Built
Calculates distance-over-time velocity between session IPs to flag impossible travel.
Executable Code
from pydantic import BaseModel, Fieldfrom langchain_openai import ChatOpenAIclass SessionEvictionPlan(BaseModel): is_session_hijacked: bool revoke_session_id: str block_attacker_ip: str justification: strdef evaluate_session_activity(session_id: str, user: str, ip1: str, loc1: str, time1: str, ip2: str, loc2: str, time2: str) -> SessionEvictionPlan: llm = ChatOpenAI(model="gpt-4o", temperature=0) structured_llm = llm.with_structured_output(SessionEvictionPlan) prompt = f"""Evaluate SaaS Session Hijacking / Impossible Travel:Session ID: {session_id}User: {user}Access 1: {ip1} ({loc1}) at {time1}Access 2: {ip2} ({loc2}) at {time2}Determine if this represents session cookie theft/hijacking.""" return structured_llm.invoke(prompt)if __name__ == "__main__": res = evaluate_session_activity( session_id="sess_abc12399", user="exec@company.com", ip1="198.51.100.10", loc1="New York, USA", time1="10:00:00 UTC", ip2="203.0.113.88", loc2="London, UK", time2="10:05:00 UTC" ) print(f"Hijacked: {res.is_session_hijacked}") print(f"Revoke Session ID: {res.revoke_session_id}") print(f"Justification: {res.justification}")
Leave a Reply