mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2.9 KiB
2.9 KiB
Workflows - XM Cyber Attack Path Analysis
Workflow 1: Continuous Exposure Management Lifecycle
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐
│ Define Critical │────>│ Deploy Sensors │────>│ Run Attack Graph │
│ Assets (Crown │ │ (On-prem + Cloud)│ │ Analysis │
│ Jewels) │ │ │ │ │
└──────────────────┘ └──────────────────┘ └──────────────────┘
│
┌────────────────────────────────────────────────┘
v
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐
│ Identify Choke │────>│ Prioritize │────>│ Remediate & │
│ Points │ │ Remediation │ │ Validate │
└──────────────────┘ └──────────────────┘ └──────────────────┘
│
v
┌──────────────────┐
│ Continuous │ (Loop back to Attack Graph Analysis)
│ Monitoring │
└──────────────────┘
Workflow 2: Choke Point Remediation
For each identified choke point:
1. Document the entity (host, credential, misconfiguration)
2. Map all attack paths passing through this choke point
3. List all critical assets protected if choke point is fixed
4. Determine remediation action (patch, reconfig, credential rotation)
5. Estimate fix complexity (easy/moderate/complex)
6. Calculate risk reduction score (paths * assets / complexity)
7. Assign to remediation team with priority and SLA
8. After fix: re-run analysis to confirm path elimination
9. Document residual risk if paths still exist
Workflow 3: Attack Path to Remediation Ticket
XM Cyber Finding:
"Cached Domain Admin credential on WORKSTATION-042
enables 47 attack paths to Domain Controller DC-01"
│
v
Remediation Ticket:
Priority: P1-Emergency
Title: "Remove cached DA cred on WORKSTATION-042"
Action: Clear credential cache, implement LAPS,
restrict DA logon to Tier 0 only
Impact: Eliminates 47 attack paths to DC-01
SLA: 48 hours