saint-graves/sica-fondt
1
0
Fork 0
mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
sica-fondt/knowledge/cyber-skills/skills/detecting-cloud-threats-with-guardduty/references/api-reference.md
Claude 24f816b6a3
Consolidate 22 sibling repos into layered organism structure 
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2026-06-10 06:53:01 +00:00

2.2 KiB
Raw Blame History

Amazon GuardDuty API Reference

GuardDuty CLI - Core Operations

# Enable GuardDuty
aws guardduty create-detector --enable \
  --finding-publishing-frequency FIFTEEN_MINUTES \
  --data-sources '{"S3Logs":{"Enable":true},"Kubernetes":{"AuditLogs":{"Enable":true}}}'

# Get detector ID
aws guardduty list-detectors --query 'DetectorIds[0]' --output text

# Get detector status
aws guardduty get-detector --detector-id $DETECTOR_ID

# Enable Runtime Monitoring
aws guardduty update-detector --detector-id $DETECTOR_ID \
  --features '[{"Name":"RUNTIME_MONITORING","Status":"ENABLED","AdditionalConfiguration":[{"Name":"ECS_FARGATE_AGENT_MANAGEMENT","Status":"ENABLED"}]}]'

Finding Management

# List findings by severity
aws guardduty list-findings --detector-id $DET \
  --finding-criteria '{"Criterion":{"severity":{"Gte":7}}}' \
  --sort-criteria '{"AttributeName":"severity","OrderBy":"DESC"}'

# Get finding details
aws guardduty get-findings --detector-id $DET --finding-ids id1 id2

# Archive findings
aws guardduty archive-findings --detector-id $DET --finding-ids id1

# Create suppression filter
aws guardduty create-filter --detector-id $DET \
  --name "SuppressDevVPC" --action ARCHIVE \
  --finding-criteria '{"Criterion":{"resource.instanceDetails.networkInterfaces.subnetId":{"Eq":["subnet-dev"]}}}'

GuardDuty Finding Severity Levels

Range Level Action
7.0 - 8.9 HIGH Immediate investigation
4.0 - 6.9 MEDIUM Investigation within 24h
1.0 - 3.9 LOW Review during business hours

Key Finding Type Prefixes

Prefix Source
Recon: Reconnaissance activity
UnauthorizedAccess: Credential or access abuse
CryptoCurrency: Mining activity
Trojan: Malware communication
Impact: Resource abuse
Exfiltration: Data theft
Persistence: Backdoor/persistence

EventBridge Rule for GuardDuty

{
  "source": ["aws.guardduty"],
  "detail-type": ["GuardDuty Finding"],
  "detail": {
    "severity": [{"numeric": [">=", 7]}]
  }
}

Threat Intel Set

aws guardduty create-threat-intel-set --detector-id $DET \
  --name "CustomBadIPs" --format TXT \
  --location s3://bucket/threat-ips.txt --activate