mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
1.9 KiB
1.9 KiB
API Reference: Detecting Insider Threat Behaviors
Risk Indicator Weights
| Indicator | Weight | Description |
|---|---|---|
| resignation_correlated | 35 | Activity after resignation notice |
| privilege_escalation | 30 | Unauthorized privilege use |
| usb_mass_copy | 30 | Mass copy to removable media |
| mass_download | 25 | Bulk file download/copy (>50 files) |
| unusual_destination | 20 | Data sent to unusual destination |
| cloud_upload | 20 | Upload to personal cloud storage |
| off_hours_access | 15 | Activity outside 8am-6pm |
| email_to_personal | 15 | Forwarding to personal email |
UEBA Data Sources
| Source | Indicators |
|---|---|
| DLP logs | File downloads, USB copies, email attachments |
| Proxy logs | Cloud storage uploads, personal email |
| VPN logs | Off-hours access, unusual locations |
| AD logs | Privilege changes, group modifications |
| Endpoint logs | Application usage, screen captures |
Splunk SPL - Mass Download Detection
index=dlp action IN ("download", "copy", "export")
| bin _time span=1h
| stats count by user, _time
| where count > 50
| sort -count
Microsoft Sentinel - Off-Hours Access
SigninLogs
| where TimeGenerated between (datetime(22:00)..datetime(06:00))
| where ResultType == 0
| summarize count() by UserPrincipalName, bin(TimeGenerated, 1h)
| where count_ > 5
Personal Cloud Domains
CLOUD_STORAGE = {
"dropbox.com", "drive.google.com",
"onedrive.live.com", "box.com",
"mega.nz", "wetransfer.com"
}
Risk Score Calculation
score = sum(RISK_INDICATORS[ind]["weight"] for ind in detected_indicators)
risk = "CRITICAL" if score >= 80 else "HIGH" if score >= 50 else "MEDIUM"
CLI Usage
python agent.py --activity-log user_activity.jsonl
python agent.py --activity-log events.csv --download-threshold 100