Incident Response Toolbox - Security Intelligence Rovo Agent

Overview

Incident Response Toolbox is a specialized Security Intelligence Agent built on the Atlassian Forge platform. It integrates with Atlassian Rovo to provide security analysts with instant access to critical security data. The agent serves as a bridge between natural language user queries and automated backend workflows, enabling streamlined retrieval of host forensics, user details, domain intelligence, and threat data.

This project demonstrates a robust Agentic workflow, significantly reducing the time analysts spend context-switching between different investigation tools (e.g., VirusTotal, Have I Been Pwned, Asset Databases).

System Architecture

The system follows a securely decoupled architecture where the Forge App handles user intent and the Automation Platform (Tines) manages the execution of sensitive security playbooks.

graph TD
    subgraph "Atlassian Cloud"
        User[Security Analyst] -- "Natural Language Query" --> Rovo[Atlassian Rovo]
        Rovo -- "Resolves Intent" --> Agent[Incident Response Toolbox Agent]
        Agent -- "Executes Function" --> Functions[Forge Lambda Functions]
    end

    subgraph "External Integration"
        Functions -- "Secure Webhook (HTTPS)" --> Tines[Tines Automation Platform]
    end

    subgraph "Security Services Orchestration"
        Tines --> VT[VirusTotal API]
        Tines --> HIBP[Have I Been Pwned]
        Tines --> Assets[Asset Inventory DB]
        Tines --> Whois[Whois Provider]
    end

    Functions -.->|Return JSON Data| Agent
    Agent -.->|Summarizes Response| Rovo
    Rovo -.->|Final Answer| User

Loading

How It Works

The Incident Response Toolbox leverages the Atlassian Rovo Agent API. Here is the data flow for a typical request:

1. User Query: The analyst asks Rovo a question, e.g., "Get details for host H-12345" or "Is example.com data safe?".
2. Intent Resolution: Rovo's LLM engine analyzes the prompt and matches it to one of the actions defined in the manifest.yml.
3. Action Execution: The corresponding Node.js function is triggered within the Atlassian Forge secure runtime.
4. Secure Handshake:
   • The function extracts relevant parameters (Host ID, Domain, Email, etc.).
   • It passes the Atlassian Account ID (AAID) to ensure every action is auditable.
   • It retrieves the target Webhook URL from Environment Variables (never hardcoded).
5. Data Retrieval: The automation platform receives the webhook, executes the investigation playbook, and aggregates the results.
6. Response Handling: The JSON data is returned to Forge, which passes it back to Rovo.
7. Presentation: Rovo synthesizes the technical JSON data into a concise, human-readable summary for the analyst.

Sequence Diagram: Domain Investigation

sequenceDiagram
    participant User as Analyst
    participant Rovo as Atlassian Rovo
    participant Forge as Forge App
    participant Auto as Automation Platform (Tines)
    
    User->>Rovo: "Who owns domain example.com?"
    Rovo->>Rovo: Identify Intent: getWhoisDetails
    Rovo->>Forge: Invoke getWhoisDetails(domain="example.com")
    activate Forge
    Forge->>Forge: Read Env: TINES_WEBHOOK_WHOIS
    Forge->>Auto: HTTPS GET /webhook/whois?domain=example.com&aaid=UserAAID
    activate Auto
    Auto->>Auto: Execute Whois Playbook
    Auto-->>Forge: 200 OK { "registrar": "Example Inc", ... }
    deactivate Auto
    Forge-->>Rovo: Return JSON Result
    deactivate Forge
    Rovo->>User: "The domain example.com is registered to..."

Loading

Supported Actions

The agent is equipped with distinct "Actions" to handle various security operations:

Action	Description	Input
Get Host and User Details	Retrieves machine inventory data and assigned user info.	hostnameorID
Get Host Forensics	Triggers remote forensic data collection for a host.	hostID, ticketNumber
Get Whois Details	Performs a WHOIS lookup for domain ownership.	domain
Get Pwned Details	Checks if an email address has appeared in known data breaches.	email
Get Host Status	Checks real-time online/offline connectivity status.	hostname
VirusTotal Scan	Retrieves reputation scores for domains, IPs, or Hashes.	domain
Phone Number Enrichment	Retrieves metadata for a given phone number.	phoneNumber

Configuration & Setup

To run this application, you must configure the following Forge Environment Variables. This ensures secrets are not stored in the codebase.

forge variables set TINES_WEBHOOK_HOST_DETAILS "https://<your-tenant>.tines.com/webhook/..."
forge variables set TINES_WEBHOOK_FORENSICS "https://<your-tenant>.tines.com/webhook/..."
forge variables set TINES_WEBHOOK_WHOIS "https://<your-tenant>.tines.com/webhook/..."
forge variables set TINES_WEBHOOK_HIBP "https://<your-tenant>.tines.com/webhook/..."
forge variables set TINES_WEBHOOK_HOST_STATUS "https://<your-tenant>.tines.com/webhook/..."
forge variables set TINES_WEBHOOK_VT "https://<your-tenant>.tines.com/webhook/..."
forge variables set TINES_WEBHOOK_PHONE "https://<your-tenant>.tines.com/webhook/..."

Technical Highlights

• Security-First Design: No API keys or Webhook URLs are hardcoded. All external communication is done via Environment Variables.
• Auditability: User context (Account ID) is passed to the backend, ensuring that all automated actions can be traced back to the initiating analyst.
• Modular Architecture: The codebase is separated into logical controllers (src/tines.js for general automation, src/hibp.js for breach data), making it easy to extend.
• Prompt Engineering: The manifest.yml defines a robust system prompt that instructs the AI to present data in a "clear and concise format" and to "exclude personal information," suitable for enterprise environments.

Deployment

1. Install Dependencies:

   npm install

2. Deploy to Atlassian Cloud:

   forge deploy

3. Install App:

   forge install