mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
100 lines
1.9 KiB
Markdown
100 lines
1.9 KiB
Markdown
# Splunk SPL Detection Rule Template
|
|
|
|
## Rule Metadata
|
|
|
|
| Field | Value |
|
|
|---|---|
|
|
| Rule Name | |
|
|
| Rule ID | |
|
|
| Description | |
|
|
| Author | |
|
|
| Date Created | |
|
|
| Last Modified | |
|
|
| Severity | |
|
|
| MITRE ATT&CK | |
|
|
| Data Sources | |
|
|
| Status | Draft / Testing / Production / Retired |
|
|
|
|
## SPL Query
|
|
|
|
```spl
|
|
| tstats summariesonly=true count
|
|
from datamodel=<DataModel>
|
|
where <conditions>
|
|
by <fields>, _time span=<interval>
|
|
| rename "<DataModel>.*" as *
|
|
| stats <aggregation> by <grouping_fields>
|
|
| where <threshold_condition>
|
|
| lookup asset_lookup ip as src OUTPUT asset_name, asset_priority
|
|
| lookup identity_lookup identity as user OUTPUT department, manager
|
|
| eval severity=case(<critical_condition>, "critical", <high_condition>, "high", true(), "medium")
|
|
| eval description="<dynamic description string>"
|
|
| eval mitre_technique="<T-number>"
|
|
```
|
|
|
|
## Detection Logic
|
|
|
|
### What This Rule Detects
|
|
<!-- Describe the adversary behavior being detected -->
|
|
|
|
### Data Sources Required
|
|
<!-- List all required data sources and their sourcetypes -->
|
|
|
|
| Source | Sourcetype | Index | Required Fields |
|
|
|---|---|---|---|
|
|
| | | | |
|
|
|
|
### Threshold Justification
|
|
<!-- Explain why the threshold values were chosen -->
|
|
|
|
### Enrichment Details
|
|
<!-- List lookups and threat intel sources used -->
|
|
|
|
## Testing Plan
|
|
|
|
### True Positive Test
|
|
<!-- Describe how to simulate the attack to validate detection -->
|
|
|
|
```
|
|
Step 1:
|
|
Step 2:
|
|
Step 3:
|
|
Expected Result:
|
|
```
|
|
|
|
### False Positive Analysis
|
|
<!-- Document known benign scenarios that trigger this rule -->
|
|
|
|
| Scenario | Source | Mitigation |
|
|
|---|---|---|
|
|
| | | |
|
|
|
|
## Tuning History
|
|
|
|
| Date | Change | Reason | Impact |
|
|
|---|---|---|---|
|
|
| | | | |
|
|
|
|
## Correlation Search Configuration
|
|
|
|
```
|
|
Schedule: */15 * * * *
|
|
Time Window: earliest=-20m latest=now
|
|
Suppress: 1h by src_ip
|
|
Notable Event Security Domain: threat
|
|
Adaptive Response: <actions>
|
|
```
|
|
|
|
## Analyst Guidance
|
|
|
|
### Triage Steps
|
|
1.
|
|
2.
|
|
3.
|
|
|
|
### Escalation Criteria
|
|
-
|
|
|
|
### Related Rules
|
|
-
|