mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
79 lines
2.6 KiB
Markdown
79 lines
2.6 KiB
Markdown
# Azure Storage Misconfiguration Detection API Reference
|
|
|
|
## Azure CLI - Storage Account Enumeration
|
|
|
|
```bash
|
|
# List all storage accounts
|
|
az storage account list --query "[].{name:name, rg:resourceGroup, https:enableHttpsTrafficOnly, tls:minimumTlsVersion, publicAccess:allowBlobPublicAccess}" -o table
|
|
|
|
# Show account details
|
|
az storage account show --name mystorageacct --resource-group myrg
|
|
|
|
# Resource Graph cross-subscription query
|
|
az graph query -q "Resources | where type == 'microsoft.storage/storageaccounts' | project name, properties.allowBlobPublicAccess, properties.minimumTlsVersion"
|
|
```
|
|
|
|
## Container Access Level Checks
|
|
|
|
```bash
|
|
# List containers with access levels
|
|
az storage container list --account-name mystorageacct \
|
|
--query "[].{name:name, access:properties.publicAccess}" -o table
|
|
|
|
# Set container to private
|
|
az storage container set-permission --name mycontainer \
|
|
--account-name mystorageacct --public-access off
|
|
```
|
|
|
|
## Network Rules
|
|
|
|
```bash
|
|
# Show network rules
|
|
az storage account network-rule list --account-name mystorageacct --resource-group myrg
|
|
|
|
# Set default action to Deny
|
|
az storage account update --name mystorageacct --resource-group myrg \
|
|
--default-action Deny
|
|
|
|
# Add IP rule
|
|
az storage account network-rule add --account-name mystorageacct \
|
|
--resource-group myrg --ip-address 203.0.113.0/24
|
|
```
|
|
|
|
## Security Settings
|
|
|
|
```bash
|
|
# Enforce HTTPS only
|
|
az storage account update --name mystorageacct -g myrg --https-only true
|
|
|
|
# Set minimum TLS 1.2
|
|
az storage account update --name mystorageacct -g myrg --min-tls-version TLS1_2
|
|
|
|
# Disable public blob access
|
|
az storage account update --name mystorageacct -g myrg --allow-blob-public-access false
|
|
|
|
# Enable soft delete
|
|
az storage blob service-properties delete-policy update \
|
|
--account-name mystorageacct --enable true --days-retained 14
|
|
```
|
|
|
|
## Azure Storage Security Checklist
|
|
|
|
| Check | CLI Command | Expected |
|
|
|-------|------------|----------|
|
|
| HTTPS only | `show --query enableHttpsTrafficOnly` | `true` |
|
|
| TLS 1.2+ | `show --query minimumTlsVersion` | `TLS1_2` |
|
|
| No public access | `show --query allowBlobPublicAccess` | `false` |
|
|
| Network deny default | `network-rule list` | `defaultAction: Deny` |
|
|
| Logging enabled | `storage logging show` | All services enabled |
|
|
| Soft delete on | `blob service-properties` | Enabled 7-14 days |
|
|
|
|
## Defender for Storage Alerts
|
|
|
|
| Alert | Description |
|
|
|-------|-------------|
|
|
| Anonymous access to storage | Unauthenticated blob access |
|
|
| Unusual data extraction | Anomalous download volume |
|
|
| Access from Tor exit node | Storage access from Tor |
|
|
| Unusual access pattern | Access from unexpected location |
|