mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
56 lines
2.1 KiB
Markdown
56 lines
2.1 KiB
Markdown
# API Reference: Implementing SIEM Use Cases for Detection
|
|
|
|
## Libraries
|
|
|
|
### attackcti (MITRE ATT&CK)
|
|
- **Install**: `pip install attackcti`
|
|
- `attack_client()` -- Initialize ATT&CK data client
|
|
- `get_techniques()` -- All techniques for coverage calculation
|
|
- `get_groups()` -- Threat groups for threat-informed use cases
|
|
|
|
### splunk-sdk (Splunk Integration)
|
|
- **Install**: `pip install splunk-sdk`
|
|
- `splunklib.client.connect()` -- Connect to Splunk instance
|
|
- `service.jobs.create(query)` -- Execute detection rule SPL
|
|
|
|
## Use Case Lifecycle
|
|
|
|
| Phase | Activities |
|
|
|-------|-----------|
|
|
| Design | Map to ATT&CK, define data sources, write detection logic |
|
|
| Test | Validate with Atomic Red Team, measure FP/TP rates |
|
|
| Deploy | Push to SIEM with alerting and SLA configuration |
|
|
| Tune | Refine based on FP feedback, add exclusions |
|
|
| Retire | Deprecate when superseded or no longer relevant |
|
|
|
|
## Key ATT&CK Techniques for Use Cases
|
|
|
|
| ID | Name | Tactic |
|
|
|----|------|--------|
|
|
| T1110 | Brute Force | Credential Access |
|
|
| T1021.002 | SMB/Windows Admin Shares | Lateral Movement |
|
|
| T1059.001 | PowerShell | Execution |
|
|
| T1048.003 | Exfiltration over DNS | Exfiltration |
|
|
| T1003.001 | LSASS Memory | Credential Access |
|
|
| T1098 | Account Manipulation | Persistence |
|
|
| T1486 | Data Encrypted for Impact | Impact |
|
|
|
|
## Sigma Rule Format
|
|
- **Spec**: https://sigmahq.io/docs/basics/rules.html
|
|
- Fields: `title`, `logsource`, `detection`, `level`, `tags`
|
|
- Tools: `sigma-cli` for converting to Splunk SPL, Elastic EQL, Sentinel KQL
|
|
- Repository: https://github.com/SigmaHQ/sigma
|
|
|
|
## Detection Quality Metrics
|
|
- True Positive Rate: Target >70%
|
|
- False Positive Rate: Target <30%
|
|
- Mean Time to Detect (MTTD): Varies by severity
|
|
- Coverage: Percentage of ATT&CK techniques with detections
|
|
|
|
## External References
|
|
- ATT&CK Techniques: https://attack.mitre.org/techniques/enterprise/
|
|
- Sigma Rules: https://github.com/SigmaHQ/sigma
|
|
- Atomic Red Team: https://github.com/redcanaryco/atomic-red-team
|
|
- Splunk ES Detections: https://research.splunk.com/detections/
|
|
- Elastic Detection Rules: https://github.com/elastic/detection-rules
|