mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
92 lines
2.5 KiB
Markdown
92 lines
2.5 KiB
Markdown
# Zeek Network Anomaly Detection API Reference
|
|
|
|
## Zeek CLI
|
|
|
|
```bash
|
|
# Process PCAP file
|
|
zeek -r capture.pcap -C
|
|
|
|
# Run on live interface
|
|
zeek -i eth1
|
|
|
|
# Run with custom script
|
|
zeek -r capture.pcap local.zeek
|
|
|
|
# ZeekControl
|
|
zeekctl deploy # Deploy and start
|
|
zeekctl status # Check status
|
|
zeekctl stop # Stop all workers
|
|
zeekctl diag # Diagnostics
|
|
```
|
|
|
|
## Zeek Log Files
|
|
|
|
| Log | Content | Key Fields |
|
|
|-----|---------|------------|
|
|
| `conn.log` | All connections | ts, id.orig_h, id.resp_h, service, duration |
|
|
| `dns.log` | DNS queries/responses | query, qtype_name, rcode_name |
|
|
| `ssl.log` | TLS handshakes | server_name, ja3, validation_status |
|
|
| `http.log` | HTTP requests | method, host, uri, user_agent |
|
|
| `files.log` | File transfers | md5, sha1, mime_type, filename |
|
|
| `notice.log` | Zeek notices/alerts | note, msg, src, dst |
|
|
| `weird.log` | Protocol anomalies | name, addl |
|
|
| `x509.log` | Certificate details | san.dns, certificate.not_valid_after |
|
|
|
|
## Zeek Scripting - Custom Detection
|
|
|
|
```zeek
|
|
# Detect DNS tunneling (long queries)
|
|
event dns_request(c: connection, msg: dns_msg, query: string, qtype: count, qclass: count) {
|
|
if (|query| > 60) {
|
|
NOTICE([$note=DNS::Tunneling,
|
|
$conn=c,
|
|
$msg=fmt("Long DNS query (%d chars): %s", |query|, query),
|
|
$identifier=cat(c$id$orig_h)]);
|
|
}
|
|
}
|
|
|
|
# Detect C2 beaconing
|
|
@load base/frameworks/sumstats
|
|
event connection_established(c: connection) {
|
|
if (Site::is_local_addr(c$id$orig_h) && !Site::is_local_addr(c$id$resp_h)) {
|
|
SumStats::observe("ext_conns",
|
|
SumStats::Key($str=cat(c$id$orig_h, "->", c$id$resp_h)),
|
|
SumStats::Observation($num=1));
|
|
}
|
|
}
|
|
```
|
|
|
|
## Zeek Log Parsing (Python)
|
|
|
|
```python
|
|
# Parse tab-separated Zeek logs
|
|
with open("conn.log") as f:
|
|
for line in f:
|
|
if line.startswith("#"):
|
|
continue
|
|
fields = line.strip().split("\t")
|
|
ts, uid, orig_h, orig_p, resp_h, resp_p = fields[:6]
|
|
```
|
|
|
|
## zeek-cut (CLI field extraction)
|
|
|
|
```bash
|
|
# Extract specific fields
|
|
cat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p service
|
|
|
|
# DNS queries sorted by count
|
|
cat dns.log | zeek-cut query | sort | uniq -c | sort -rn | head -20
|
|
|
|
# JA3 fingerprints
|
|
cat ssl.log | zeek-cut ja3 server_name | sort | uniq -c | sort -rn
|
|
```
|
|
|
|
## Beaconing Detection Formula
|
|
|
|
```
|
|
interval_avg = mean(connection_intervals)
|
|
jitter = mean(|interval - interval_avg|) / interval_avg
|
|
if jitter < 0.15 and connections > 10:
|
|
flag as potential C2 beacon
|
|
```
|