mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
76 lines
2.4 KiB
Markdown
76 lines
2.4 KiB
Markdown
# API Reference: Detecting Insider Threat with UEBA
|
|
|
|
## Elasticsearch Aggregation Queries
|
|
|
|
### Per-User Daily Activity Baseline
|
|
```json
|
|
{
|
|
"aggs": {
|
|
"users": {
|
|
"terms": {"field": "user.name", "size": 5000},
|
|
"aggs": {
|
|
"daily_events": {"date_histogram": {"field": "@timestamp", "calendar_interval": "day"}},
|
|
"unique_hosts": {"cardinality": {"field": "host.name"}},
|
|
"data_volume": {"sum": {"field": "bytes_transferred"}}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
```
|
|
|
|
### Anomaly Detection (Z-Score > 3)
|
|
```python
|
|
from elasticsearch import Elasticsearch
|
|
es = Elasticsearch(["https://localhost:9200"], api_key="base64key")
|
|
result = es.search(index="logs-*", body=query)
|
|
z_score = (current - baseline_avg) / baseline_std
|
|
```
|
|
|
|
## Insider Threat Indicators
|
|
|
|
| Indicator | Detection Method | Severity |
|
|
|-----------|-----------------|----------|
|
|
| Activity spike | Z-score > 3 standard deviations | High |
|
|
| Data exfiltration | Volume > 5x daily average | Critical |
|
|
| New host access | Unique hosts > 2x baseline | High |
|
|
| Off-hours activity | Login outside 06:00-22:00 | Medium |
|
|
| Peer group outlier | Activity > 3x peer average | Medium |
|
|
| Privilege escalation | New admin role assignment | Critical |
|
|
| Resignation + download | HR flag + high data volume | Critical |
|
|
|
|
## Elasticsearch Python Client
|
|
|
|
```bash
|
|
pip install elasticsearch>=8.0
|
|
```
|
|
|
|
| Method | Description |
|
|
|--------|-------------|
|
|
| `es.search(index, body)` | Execute aggregation query |
|
|
| `es.indices.get_alias("logs-*")` | List matching indices |
|
|
| `es.count(index)` | Get document count |
|
|
|
|
## Risk Scoring Model
|
|
|
|
| Score Range | Risk Level | Action |
|
|
|-------------|------------|--------|
|
|
| 0 - 30 | Low | No action |
|
|
| 31 - 60 | Medium | Monitor |
|
|
| 61 - 80 | High | SOC investigation |
|
|
| 81 - 100 | Critical | Immediate response |
|
|
|
|
## MITRE ATT&CK Insider Techniques
|
|
|
|
| Technique | ID | UEBA Detection |
|
|
|-----------|----|----------------|
|
|
| Data from Local System | T1005 | Volume anomaly on file servers |
|
|
| Exfiltration Over Web Service | T1567 | Cloud upload volume spike |
|
|
| Account Manipulation | T1098 | Unusual privilege changes |
|
|
| Valid Accounts | T1078 | Off-hours or location anomaly |
|
|
|
|
### References
|
|
|
|
- Elasticsearch Python Client: https://elasticsearch-py.readthedocs.io/
|
|
- MITRE Insider Threat: https://attack.mitre.org/techniques/T1078/
|
|
- NIST SP 800-53 AC-2: https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/
|