Deception Environment Refresh

#!/bin/bash
# refresh-deception-environment.sh
# Rotate deception assets after adversary engagement.
# Replaces interacted assets with fresh configurations to prevent
# adversaries from recognizing previously encountered decoys.

set -euo pipefail

ENGAGEMENT_ID="$1"
TERRAFORM_DIR="/opt/shadow-cdf/terraform"
ANSIBLE_DIR="/opt/shadow-cdf/ansible"
LOG_FILE="/var/log/shadow-cdf/refresh-$(date +%Y%m%d).log"

log() { echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*" | tee -a "$LOG_FILE"; }

log "Starting deception environment refresh for engagement: $ENGAGEMENT_ID"

# 1. Identify assets that were interacted with
log "Querying SIEM for interacted assets..."
INTERACTED_HOSTS=$(curl -s "https://siem.shadow-mgmt.internal/api/v1/query" \
    -H "Authorization: Bearer $SIEM_TOKEN" \
    -d "{
        \"query\": \"shadow_cdf:true AND engagement_id:$ENGAGEMENT_ID\",
        \"agg\": \"terms:destination.ip\"
    }" | jq -r '.aggregations.terms.buckets[].key')

log "Interacted assets: $INTERACTED_HOSTS"

# 2. Destroy interacted assets
for HOST_IP in $INTERACTED_HOSTS; do
    log "Destroying interacted asset: $HOST_IP"
    cd "$TERRAFORM_DIR"
    terraform destroy -target="module.decoy_host[\"$HOST_IP\"]" -auto-approve
done

# 3. Generate new configurations with different parameters
log "Generating fresh deception asset configurations..."
NEW_HOSTNAME_SUFFIX=$((RANDOM % 90 + 10))

cd "$TERRAFORM_DIR"
terraform apply \
    -var="hostname_suffix=$NEW_HOSTNAME_SUFFIX" \
    -var="refresh_trigger=$(date +%s)" \
    -auto-approve

# 4. Re-configure with fresh artifacts
log "Applying fresh Ansible configurations..."
cd "$ANSIBLE_DIR"
ansible-playbook playbooks/configure-decoy-host.yml \
    --extra-vars "refresh_mode=true engagement=$ENGAGEMENT_ID"

# 5. Rotate trap credentials
log "Rotating trap credentials..."
ansible-playbook playbooks/rotate-trap-credentials.yml

# 6. Redistribute canary tokens
log "Redistributing canary tokens..."
python3 /opt/shadow-cdf/scripts/canary-token-manager.py \
    --action rotate \
    --engagement "$ENGAGEMENT_ID"

# 7. Update DNS records for new assets
log "Updating DNS breadcrumbs..."
ansible-playbook playbooks/update-dns-breadcrumbs.yml

# 8. Validate new environment
log "Validating refreshed environment..."
python3 /opt/shadow-cdf/scripts/validate-deception-env.py

log "Deception environment refresh complete."
log "New assets deployed with hostname suffix: $NEW_HOSTNAME_SUFFIX"
log "Archive engagement data: /var/archive/shadow-cdf/$ENGAGEMENT_ID/"