mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
5.0 KiB
5.0 KiB
OpenCTI IOC Enrichment Workflows
Workflow 1: Automatic Enrichment Pipeline
[New Observable Created] --> [RabbitMQ Queue] --> [Enrichment Connectors]
|
+-----------+-----------+
| | |
v v v
[VirusTotal] [Shodan] [AbuseIPDB]
| | |
v v v
[STIX Bundle] [STIX Bundle] [STIX Bundle]
| | |
+-----------+-----------+
|
v
[Merged into OpenCTI]
|
v
[Confidence Updated]
Steps:
- Observable Ingestion: New IP/domain/hash created via feed import or manual entry
- Queue Distribution: OpenCTI sends observable to enrichment connector queues
- Parallel Enrichment: Each connector queries its respective external API
- STIX Bundle Generation: Connectors produce STIX 2.1 bundles with notes, labels, relationships
- Merge: Enrichment results merged into the observable's knowledge graph
- Scoring: Confidence score updated based on aggregated enrichment data
Workflow 2: Analyst-Triggered Enrichment
[Analyst Selects Observable] --> [Manual Enrichment Request] --> [Selected Connectors]
| |
v v
[Review Results] <-- [Enrichment Dashboard] <-- [Results Returned]
|
v
[Update Tags/Labels] --> [Add to Investigation]
Steps:
- Selection: Analyst identifies observable requiring additional context
- Connector Choice: Select specific enrichment connectors to run
- Execution: Connectors query external services with observable value
- Review: Analyst reviews enrichment results in observable detail view
- Curation: Analyst updates labels, confidence, and adds notes
- Investigation: Link enriched observable to ongoing investigation case
Workflow 3: Bulk Enrichment Pipeline
[STIX Import] --> [Observable Extraction] --> [Batch Queue] --> [Rate-Limited Enrichment]
|
v
[Progress Tracking]
|
v
[Enrichment Report]
Steps:
- Bulk Import: Import STIX bundle with hundreds of observables
- Extraction: OpenCTI extracts unique observables from imported data
- Queue Management: Observables queued for enrichment with rate limiting
- Progressive Enrichment: Connectors process queue respecting API rate limits
- Monitoring: Track enrichment progress via connector status dashboard
- Reporting: Generate enrichment summary with coverage statistics
Workflow 4: Enrichment-Driven Scoring
[Raw IOC (Score: 0)] --> [VirusTotal] --> [Score += VT_detections/total * 30]
|
v
[AbuseIPDB] --> [Score += abuse_confidence * 0.3]
|
v
[GreyNoise] --> [Score += classification_weight]
|
v
[Shodan] --> [Score += open_ports_risk]
|
v
[Final Score (0-100)] --> [Priority Classification]
|
+---------+---------+
| | |
v v v
[Critical] [High] [Low]
(80-100) (50-79) (0-49)
Steps:
- Baseline: Observable starts with confidence score of 0
- VT Score: VirusTotal detection ratio contributes up to 30 points
- Abuse Score: AbuseIPDB confidence contributes up to 30 points
- Classification: GreyNoise malicious/benign classification adds/subtracts points
- Exposure: Shodan data on open ports and known vulnerabilities adds risk points
- Final Priority: Aggregated score determines analyst priority queue placement