mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
69 lines
1.9 KiB
Markdown
69 lines
1.9 KiB
Markdown
# API Reference: Detecting Insider Threat Behaviors
|
|
|
|
## Risk Indicator Weights
|
|
|
|
| Indicator | Weight | Description |
|
|
|-----------|--------|-------------|
|
|
| resignation_correlated | 35 | Activity after resignation notice |
|
|
| privilege_escalation | 30 | Unauthorized privilege use |
|
|
| usb_mass_copy | 30 | Mass copy to removable media |
|
|
| mass_download | 25 | Bulk file download/copy (>50 files) |
|
|
| unusual_destination | 20 | Data sent to unusual destination |
|
|
| cloud_upload | 20 | Upload to personal cloud storage |
|
|
| off_hours_access | 15 | Activity outside 8am-6pm |
|
|
| email_to_personal | 15 | Forwarding to personal email |
|
|
|
|
## UEBA Data Sources
|
|
|
|
| Source | Indicators |
|
|
|--------|------------|
|
|
| DLP logs | File downloads, USB copies, email attachments |
|
|
| Proxy logs | Cloud storage uploads, personal email |
|
|
| VPN logs | Off-hours access, unusual locations |
|
|
| AD logs | Privilege changes, group modifications |
|
|
| Endpoint logs | Application usage, screen captures |
|
|
|
|
## Splunk SPL - Mass Download Detection
|
|
|
|
```spl
|
|
index=dlp action IN ("download", "copy", "export")
|
|
| bin _time span=1h
|
|
| stats count by user, _time
|
|
| where count > 50
|
|
| sort -count
|
|
```
|
|
|
|
## Microsoft Sentinel - Off-Hours Access
|
|
|
|
```kql
|
|
SigninLogs
|
|
| where TimeGenerated between (datetime(22:00)..datetime(06:00))
|
|
| where ResultType == 0
|
|
| summarize count() by UserPrincipalName, bin(TimeGenerated, 1h)
|
|
| where count_ > 5
|
|
```
|
|
|
|
## Personal Cloud Domains
|
|
|
|
```python
|
|
CLOUD_STORAGE = {
|
|
"dropbox.com", "drive.google.com",
|
|
"onedrive.live.com", "box.com",
|
|
"mega.nz", "wetransfer.com"
|
|
}
|
|
```
|
|
|
|
## Risk Score Calculation
|
|
|
|
```python
|
|
score = sum(RISK_INDICATORS[ind]["weight"] for ind in detected_indicators)
|
|
risk = "CRITICAL" if score >= 80 else "HIGH" if score >= 50 else "MEDIUM"
|
|
```
|
|
|
|
## CLI Usage
|
|
|
|
```bash
|
|
python agent.py --activity-log user_activity.jsonl
|
|
python agent.py --activity-log events.csv --download-threshold 100
|
|
```
|