mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
58 lines
2.8 KiB
Markdown
58 lines
2.8 KiB
Markdown
# STIX/TAXII Feed Integration Workflows
|
|
|
|
## Workflow 1: TAXII Feed Consumption
|
|
|
|
```
|
|
[TAXII Discovery] --> [API Root Enumeration] --> [Collection Selection] --> [Object Polling]
|
|
|
|
|
v
|
|
[STIX Parsing] --> [IOC Extraction]
|
|
|
|
|
v
|
|
[SIEM/TIP Ingestion]
|
|
```
|
|
|
|
### Steps:
|
|
1. **Discovery**: Query TAXII server discovery endpoint for available API roots
|
|
2. **Root Enumeration**: List available API roots and their supported features
|
|
3. **Collection Listing**: Enumerate collections with read/write permissions
|
|
4. **Incremental Polling**: Fetch new objects using added_after timestamp filter
|
|
5. **STIX Parsing**: Deserialize JSON into typed STIX objects
|
|
6. **IOC Extraction**: Extract indicators, observables, and relationships
|
|
7. **Platform Ingestion**: Push to SIEM, MISP, or OpenCTI
|
|
|
|
## Workflow 2: STIX Bundle Production
|
|
|
|
```
|
|
[IOC Sources] --> [Normalization] --> [STIX Object Creation] --> [Bundle Assembly]
|
|
|
|
|
v
|
|
[TAXII Publication]
|
|
```
|
|
|
|
### Steps:
|
|
1. **Source Collection**: Gather IOCs from internal analysis, feeds, incident response
|
|
2. **Normalization**: Standardize IOC formats and remove duplicates
|
|
3. **Object Creation**: Create STIX Indicators, Observables, and Relationships
|
|
4. **TLP Marking**: Apply appropriate TLP marking definitions
|
|
5. **Bundle Assembly**: Package objects into STIX 2.1 bundles
|
|
6. **TAXII Push**: POST bundles to writable TAXII collections
|
|
|
|
## Workflow 3: Multi-Feed Aggregation
|
|
|
|
```
|
|
[TAXII Feed A] --+
|
|
|--> [Deduplication] --> [Correlation] --> [Unified Store]
|
|
[TAXII Feed B] --+ |
|
|
| v
|
|
[STIX File C] ---+ [Dashboard/Alerts]
|
|
```
|
|
|
|
### Steps:
|
|
1. **Feed Registration**: Configure multiple TAXII and file-based STIX sources
|
|
2. **Parallel Polling**: Poll all feeds concurrently with rate limiting
|
|
3. **Deduplication**: Remove duplicate objects by STIX ID and modified timestamp
|
|
4. **Correlation**: Link related objects across feeds via relationships
|
|
5. **Unified Storage**: Store in MemoryStore, FileSystemStore, or database-backed store
|
|
6. **Output**: Generate alerts, dashboards, or exports for downstream consumers
|