mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
1.5 KiB
1.5 KiB
API Reference: Implementing Email Sandboxing with Proofpoint
Proofpoint TAP SIEM API
import requests
resp = requests.get(
"https://tap-api-v2.proofpoint.com/v2/siem/all",
auth=(principal, secret),
params={"sinceSeconds": 3600, "format": "json"})
data = resp.json()
# Keys: messagesDelivered, messagesBlocked, clicksPermitted, clicksBlocked
TAP API Endpoints
| Endpoint | Description |
|---|---|
/v2/siem/all |
All threat events |
/v2/siem/messages/blocked |
Blocked messages only |
/v2/siem/messages/delivered |
Delivered threats |
/v2/siem/clicks/blocked |
Blocked URL clicks |
/v2/siem/clicks/permitted |
Permitted URL clicks |
Threat Categories
| Category | Description | Severity |
|---|---|---|
| Malware | Malicious attachment | CRITICAL |
| Phish | Credential harvesting | HIGH |
| Impostor | BEC/spoofing | HIGH |
| Spam | Unsolicited | LOW |
URL Defense Configuration
{
"url_defense": {
"rewrite_all_urls": true,
"real_time_scanning": true,
"sandbox_detonation": true,
"click_time_protection": true
}
}
Splunk Integration
index=proofpoint sourcetype=tap:siem
| where classification="malicious"
| stats count by sender, threatType, subject
References
- Proofpoint TAP API: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation
- Proofpoint Email Protection: https://www.proofpoint.com/us/products/email-security-and-protection