mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
108 lines
3.0 KiB
Markdown
108 lines
3.0 KiB
Markdown
# MISP Intelligence Collection Report Template
|
|
|
|
## Report Metadata
|
|
| Field | Value |
|
|
|-------|-------|
|
|
| Report ID | MISP-COL-YYYY-NNNN |
|
|
| Date Generated | YYYY-MM-DD HH:MM UTC |
|
|
| MISP Instance | https://misp.example.com |
|
|
| Collection Period | YYYY-MM-DD to YYYY-MM-DD |
|
|
| Classification | TLP:AMBER |
|
|
| Analyst | [Analyst Name] |
|
|
|
|
## Executive Summary
|
|
|
|
Brief overview of threat intelligence collected during the reporting period, including total events processed, notable threat campaigns identified, and key IOCs requiring immediate action.
|
|
|
|
## Collection Statistics
|
|
|
|
| Metric | Count |
|
|
|--------|-------|
|
|
| Total Events Processed | |
|
|
| New Events Created | |
|
|
| Attributes Collected | |
|
|
| IDS-Flagged Indicators | |
|
|
| Warninglist Filtered | |
|
|
| Feeds Active | |
|
|
| Correlations Found | |
|
|
|
|
## Feed Status
|
|
|
|
| Feed Name | Provider | Last Fetch | Status | Events Generated |
|
|
|-----------|----------|------------|--------|-----------------|
|
|
| CIRCL OSINT | CIRCL | | Active/Error | |
|
|
| Botvrij.eu | Botvrij | | Active/Error | |
|
|
| URLhaus | abuse.ch | | Active/Error | |
|
|
| PhishTank | OpenDNS | | Active/Error | |
|
|
|
|
## Top IOC Categories
|
|
|
|
### Network Indicators
|
|
| Type | Count | Sample Values |
|
|
|------|-------|---------------|
|
|
| IP Addresses (dst) | | |
|
|
| IP Addresses (src) | | |
|
|
| Domains | | |
|
|
| URLs | | |
|
|
| Hostnames | | |
|
|
|
|
### File Indicators
|
|
| Type | Count | Sample Values |
|
|
|------|-------|---------------|
|
|
| MD5 Hashes | | |
|
|
| SHA-1 Hashes | | |
|
|
| SHA-256 Hashes | | |
|
|
| Filenames | | |
|
|
|
|
### Email Indicators
|
|
| Type | Count | Sample Values |
|
|
|------|-------|---------------|
|
|
| Email Addresses | | |
|
|
| Email Subjects | | |
|
|
| Attachment Names | | |
|
|
|
|
## Notable Campaigns
|
|
|
|
### Campaign 1: [Campaign Name]
|
|
- **Threat Actor**: [Actor Name/Group]
|
|
- **MITRE ATT&CK Techniques**: T1566, T1059, T1071
|
|
- **IOC Count**: N indicators
|
|
- **First Seen**: YYYY-MM-DD
|
|
- **TLP**: AMBER
|
|
- **Key Indicators**:
|
|
- IP: x.x.x.x (C2 Server)
|
|
- Domain: malicious-domain.com
|
|
- SHA256: [hash]
|
|
|
|
## Correlation Highlights
|
|
|
|
Events sharing common indicators across multiple campaigns or threat actors:
|
|
|
|
| Indicator | Events Linked | Threat Actors | Confidence |
|
|
|-----------|--------------|---------------|------------|
|
|
| | | | High/Medium/Low |
|
|
|
|
## Export Summary
|
|
|
|
| Format | Destination | Record Count | Timestamp |
|
|
|--------|-------------|-------------|-----------|
|
|
| STIX 2.1 | OpenCTI | | |
|
|
| Suricata Rules | IDS/IPS | | |
|
|
| CSV | SIEM (Splunk) | | |
|
|
| JSON | Threat Hunting | | |
|
|
|
|
## Recommendations
|
|
|
|
1. **Immediate Actions**: Block high-confidence IOCs in firewall/proxy
|
|
2. **Monitoring**: Add medium-confidence IOCs to watchlists
|
|
3. **Investigation**: Review events tagged with threat level "high"
|
|
4. **Feed Maintenance**: Review and update feed configurations
|
|
5. **Sharing**: Publish sanitized events to community instances
|
|
|
|
## Appendix: IOC Export
|
|
|
|
Full IOC list exported to:
|
|
- `misp_iocs_export.csv` - CSV format for SIEM ingestion
|
|
- `misp_stix_bundle.json` - STIX 2.1 bundle for CTI platforms
|
|
- `misp_suricata.rules` - Suricata IDS rules for network detection
|