Add dual_signal_containment_gate custom function

[AAH20]

Summary

Adds a reusable community custom function so Splunk SOAR playbooks can deny auto-contain when an event is ML-only.

Community block ip / risk_notable_block_indicators paths currently flatten SnortML probability into a signature true positive. False containment is an outage and a change ticket.

Hard rule: ML confidence ≠ signature true positive.

This follows the same contribution shape as ip_classify (#238) and generate_password (#237): a Python 3.13 / platform 8.6 custom function, not a fork of every historical block_indicators branch.

Behavior

Call community/dual_signal_containment_gate with notable/container text plus optional generator_id, classification, and eve_threat_confidence. Filter before block ip:

disposition	allow_auto_contain	When
ml_only	false	SnortML GID 411, is_ml_only, or EVE ≥ 80 without a classic signature
signature	true	Classic GID / high-priority classification
corroborated	true	Classic signature and ML/EVE
unknown	false	Fail closed; require HITL

GID 411 plus a leftover class_desc is still ML-only (that field is not a classic signature TP).

Filter example: allow_auto_contain == "false" → prompt or stop; do not launch block ip.

Wiring

Intended consumers (no edits in this PR):

• risk_notable_block_indicators and tagged block, risk_notable child playbooks
• PAN / FMC / Umbrella block ip actions on Cisco Secure Firewall notables

Pass container.name + container.description (and CEF GeneratorID / classification / EVE when present).

Compounds

• ESCU dual-signal detections: feat: Dual-signal SnortML (GID 411) + signature/EVE corroboration analytics for Cisco Secure Firewall splunk/security_content#4220 · feat: SnortML GID411 and signature+EVE dual-signal CSF detections splunk/security_content#4221
• Sentinel BlockIP Gate/Prove: Deny auto BlockIP on ML-only Firepower incidents (Gate/Prove) Azure/Azure-Sentinel#14926
• EvidenceForge: feat: labeled dual-signal SnortML+signature and Splunk-notable triage corpus Cisco-Talos/EvidenceForge#389

Optional production Gate/Prove consumer (paid Continuous Trust, not unpaid R&D): https://github.com/AAH20/aegis-decision-fabric · https://a2zsoc.com/consultation

Test plan

• Local cases: GID 411 / is_ml_only / EVE 92 → ml_only + deny
• GID 1 + attempted-admin → signature + allow
• GID 1 + EVE 88 → corroborated + allow
• GID 411 + attempted-admin class_desc → still ml_only
• Empty context → unknown + deny
• Pylint E,F (--disable=W,C,R,I,E0401) 10/10
• CI AutomationCodeScanner on custom_functions/*.py
• Maintainer: call from a test container before block ip on a SnortML notable

Made with Cursor