mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2.6 KiB
2.6 KiB
Azure Storage Misconfiguration Detection API Reference
Azure CLI - Storage Account Enumeration
# List all storage accounts
az storage account list --query "[].{name:name, rg:resourceGroup, https:enableHttpsTrafficOnly, tls:minimumTlsVersion, publicAccess:allowBlobPublicAccess}" -o table
# Show account details
az storage account show --name mystorageacct --resource-group myrg
# Resource Graph cross-subscription query
az graph query -q "Resources | where type == 'microsoft.storage/storageaccounts' | project name, properties.allowBlobPublicAccess, properties.minimumTlsVersion"
Container Access Level Checks
# List containers with access levels
az storage container list --account-name mystorageacct \
--query "[].{name:name, access:properties.publicAccess}" -o table
# Set container to private
az storage container set-permission --name mycontainer \
--account-name mystorageacct --public-access off
Network Rules
# Show network rules
az storage account network-rule list --account-name mystorageacct --resource-group myrg
# Set default action to Deny
az storage account update --name mystorageacct --resource-group myrg \
--default-action Deny
# Add IP rule
az storage account network-rule add --account-name mystorageacct \
--resource-group myrg --ip-address 203.0.113.0/24
Security Settings
# Enforce HTTPS only
az storage account update --name mystorageacct -g myrg --https-only true
# Set minimum TLS 1.2
az storage account update --name mystorageacct -g myrg --min-tls-version TLS1_2
# Disable public blob access
az storage account update --name mystorageacct -g myrg --allow-blob-public-access false
# Enable soft delete
az storage blob service-properties delete-policy update \
--account-name mystorageacct --enable true --days-retained 14
Azure Storage Security Checklist
| Check | CLI Command | Expected |
|---|---|---|
| HTTPS only | show --query enableHttpsTrafficOnly |
true |
| TLS 1.2+ | show --query minimumTlsVersion |
TLS1_2 |
| No public access | show --query allowBlobPublicAccess |
false |
| Network deny default | network-rule list |
defaultAction: Deny |
| Logging enabled | storage logging show |
All services enabled |
| Soft delete on | blob service-properties |
Enabled 7-14 days |
Defender for Storage Alerts
| Alert | Description |
|---|---|
| Anonymous access to storage | Unauthenticated blob access |
| Unusual data extraction | Anomalous download volume |
| Access from Tor exit node | Storage access from Tor |
| Unusual access pattern | Access from unexpected location |