mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
49 lines
1.9 KiB
Markdown
49 lines
1.9 KiB
Markdown
# Historian Server Attack Detection — API Reference
|
|
|
|
## Common Historian Platforms
|
|
|
|
| Platform | Vendor | Default Port |
|
|
|----------|--------|-------------|
|
|
| PI Data Archive | OSIsoft/AVEVA | 5457 |
|
|
| PI Web API | OSIsoft/AVEVA | 443/5459 |
|
|
| Wonderware Historian | AVEVA | 1433 (SQL) |
|
|
| FactoryTalk Historian | Rockwell | 1433 (SQL) |
|
|
| Ignition Gateway | Inductive Automation | 8088 |
|
|
| iFIX Historian | GE Digital | 5051 |
|
|
|
|
## OSIsoft PI Web API Endpoints
|
|
|
|
| Method | Endpoint | Description |
|
|
|--------|----------|-------------|
|
|
| GET | `/piwebapi/system` | System information and version |
|
|
| GET | `/piwebapi/points` | List PI data points |
|
|
| GET | `/piwebapi/streams/{webId}/value` | Get current point value |
|
|
| GET | `/piwebapi/streams/{webId}/recorded` | Get historical recorded values |
|
|
| GET | `/piwebapi/dataservers` | List configured data servers |
|
|
|
|
## Ignition Gateway Endpoints
|
|
|
|
| Endpoint | Description |
|
|
|----------|-------------|
|
|
| `/StatusPing` | Gateway health check |
|
|
| `/system/gwinfo` | Gateway system information |
|
|
| `/system/webdev` | Web development module |
|
|
| `/main/web/status` | Gateway status page |
|
|
|
|
## Attack Indicators
|
|
|
|
| Indicator | Description | Severity |
|
|
|-----------|-------------|----------|
|
|
| Anonymous API access | PI Web API accessible without auth | CRITICAL |
|
|
| Bulk data read | >10,000 points read in single session | CRITICAL |
|
|
| Brute force login | >5 failed logins from same IP | HIGH |
|
|
| Exposed gateway info | Ignition/PI info pages publicly accessible | HIGH |
|
|
| SQL injection on historian DB | Direct SQL queries to historian backend | CRITICAL |
|
|
|
|
## External References
|
|
|
|
- [OSIsoft PI Web API Reference](https://docs.aveva.com/bundle/pi-web-api-reference)
|
|
- [Ignition Gateway API](https://docs.inductiveautomation.com/docs/8.1/platform/gateway)
|
|
- [CISA ICS-CERT: Historian Security](https://www.cisa.gov/ics)
|
|
- [NIST SP 800-82 Rev 3](https://csrc.nist.gov/publications/detail/sp/800-82/rev-3/final)
|