saint-graves/sica-fondt
1
0
Fork 0
mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 16:40:24 +00:00
Code Issues Packages Projects Releases Wiki Activity
sica-fondt/knowledge/cyber-skills/skills/implementing-ot-network-traffic-analysis-with-nozomi/references/api-reference.md
Claude 24f816b6a3
Consolidate 22 sibling repos into layered organism structure 
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2026-06-10 06:53:01 +00:00

2.3 KiB
Raw Blame History

API Reference: Implementing OT Network Traffic Analysis with Nozomi

Nozomi Guardian REST API

Endpoint Method Description
/api/v1/alerts GET Retrieve security alerts
/api/v1/assets GET Get discovered asset inventory
/api/v1/nodes GET Get network nodes
/api/v1/links GET Get network links/connections
/api/v1/sessions GET Get active network sessions
/api/v1/queries POST Execute N2OS query
/api/v1/health GET Sensor health status

Authentication

# Bearer token
curl -s -k -H "Authorization: Bearer <token>" https://guardian/api/v1/assets

# API key (Vantage)
curl -s -H "X-Api-Key: <key>" https://vantage.nozominetworks.com/api/v1/assets

N2OS Query Language

-- Find all PLCs
alerts | where type == plc

-- Find new connections in last 24h
sessions | where first_seen > ago(24h) | sort by bytes desc

-- Find Modbus traffic
sessions | where protocol == modbus | select src_ip, dst_ip, function_code

Supported OT Protocols

Protocol Detection DPI Support
Modbus/TCP Full Function code analysis
S7comm Full Block read/write detection
EtherNet/IP (CIP) Full Service code inspection
DNP3 Full Object group parsing
OPC UA Full Service/node inspection
BACnet Full Object/property analysis
PROFINET Full Cyclic/acyclic detection
IEC 60870-5-104 Full ASDU type parsing

Alert Risk Levels

Level Score Range Response
Critical 9.0 - 10.0 Immediate investigation
High 7.0 - 8.9 Investigate within 4 hours
Medium 4.0 - 6.9 Investigate within 24 hours
Low 0.1 - 3.9 Review during next shift

Sensor Deployment

Mode Use Case
SPAN/Mirror Switch mirror port monitoring
TAP Network TAP for full-duplex capture
Smart Polling Active query for asset enrichment

References