Moltbot Threat Detection — Du hast keine Threat Detection, kein Falco, kein Prometheus Alerting. Angriffe werden erst nach Tagen entdeckt, Daten-Leak, dein CEO hat den CISO gefeuert.

# prometheus/alerts/moltbot-security.yml
groups:
  - name: moltbot-security
    rules:
      - alert: MoltbotHighAuthFailureRate
        expr: |
          rate(moltbot_auth_failures_total[5m]) > 10
        for: 2m
        labels:
          severity: warning
        annotations:
          summary: "Hohe Authentifizierungsfehlerrate"
          description: "{{ $value }} Fehlschläge/s – möglicher Brute-Force-Angriff"

      - alert: MoltbotSuspiciousAPIActivity
        expr: |
          rate(moltbot_api_requests_total{status="429"}[1m]) > 50
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "Verdächtige API-Aktivität erkannt"
          description: "{{ $value }} Rate-Limited Requests/s"

      - alert: MoltbotDatabaseQueryAnomaly
        expr: |
          histogram_quantile(0.99, rate(moltbot_db_query_duration_seconds_bucket[5m])) > 5
        for: 3m
        labels:
          severity: warning
        annotations:
          summary: "Anomale Datenbankabfrage-Latenz"
          description: "P99 Latenz: {{ $value }}s"}

// moltbot/lib/incident-response.ts
import { Redis } from '@upstash/redis';

const redis = new Redis({ url: process.env.UPSTASH_REDIS_REST_URL!, token: process.env.UPSTASH_REDIS_REST_TOKEN! });

export async function handleSecurityIncident(incident: {
  type: 'brute_force' | 'injection' | 'anomaly';
  ip: string;
  severity: 'low' | 'medium' | 'high' | 'critical';
  details: Record<string, unknown>;
}) {
  // 1. IP blockieren bei kritischen Incidents
  if (incident.severity === 'critical' || incident.severity === 'high') {
    await redis.setex(`block:${incident.ip}`, 3600, '1');
  }

  // 2. Incident loggen
  await redis.lpush('incidents', JSON.stringify({
    ...incident,
    timestamp: new Date().toISOString(),
  }));

  // 3. Alert senden
  if (incident.severity === 'critical') {
    await fetch(process.env.SLACK_WEBHOOK_URL!, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({
        text: `🚨 CRITICAL Security Incident: ${incident.type} from ${incident.ip}`,
      }),
    });
  }
}