mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
3.1 KiB
3.1 KiB
Velociraptor IR Collection Workflows
Workflow 1: Rapid Triage Collection
START: Incident Detected - Triage Needed
|
v
[Identify Target Endpoints]
|-- Search clients by hostname, IP, or label
|-- Verify client connectivity status
|-- Label endpoints as "investigation_targets"
|
v
[Launch Triage Collection]
|-- Select triage artifact pack
|-- Configure collection parameters
|-- Set resource limits (CPU, bandwidth)
|-- Launch flow on target endpoints
|
v
[Monitor Collection Progress]
|-- View flow status in Velociraptor UI
|-- Check for collection errors
|-- Verify artifact completeness
|
v
[Download and Analyze Results]
|-- Export collected data
|-- Import into timeline tool
|-- Begin forensic analysis
|
v
END: Triage Data Available for Analysis
Workflow 2: Enterprise-Wide Hunt
START: IOC or Threat Intelligence Received
|
v
[Create Hunt]
|-- Define hunt description and scope
|-- Select target artifacts
|-- Configure IOC-based VQL queries
|-- Set include/exclude labels
|
v
[Launch Hunt]
|-- Deploy to all matching endpoints
|-- Offline endpoints queued for pickup
|-- Monitor completion percentage
|
v
[Analyze Hunt Results]
|-- Review matches and anomalies
|-- Identify compromised endpoints
|-- Label affected systems
|
v
[Escalate Findings]
|-- Create detailed flows for hits
|-- Collect additional artifacts
|-- Feed results into IR process
|
v
END: Hunt Complete - Findings Documented
Workflow 3: Live Incident Response
START: Active Compromise Detected
|
v
[Connect to Affected Endpoint]
|-- Open VQL shell in Velociraptor UI
|-- Verify system identity and status
|
v
[Volatile Evidence Collection]
|-- Running processes (pslist)
|-- Network connections (netstat)
|-- DNS cache
|-- Open file handles
|-- Loaded DLLs
|-- Memory strings (if needed)
|
v
[Persistence Check]
|-- Scheduled tasks
|-- Services
|-- Registry autorun keys
|-- WMI subscriptions
|-- Startup folder items
|
v
[Non-Volatile Evidence]
|-- Event logs
|-- Prefetch files
|-- MFT entries
|-- Browser history
|-- PowerShell history
|
v
[Containment Decision]
|-- Enough evidence to contain?
|-- Isolate endpoint if needed
|-- Continue monitoring if needed
|
v
END: Evidence Collected - Containment Executed
Workflow 4: Deployment at Scale
START: Velociraptor Deployment Project
|
v
[Server Setup]
|-- Deploy server on dedicated host
|-- Configure SSL certificates
|-- Set up authentication (SSO/SAML)
|-- Configure storage backend
|
v
[Client Configuration]
|-- Generate client config from server
|-- Repack client installers
|-- Test on pilot group
|
v
[Mass Deployment]
|-- GPO deployment (Windows)
|-- Configuration management (Linux)
|-- MDM deployment (macOS)
|-- Verify connectivity
|
v
[Operational Configuration]
|-- Set up monitoring artifacts
|-- Configure event forwarding
|-- Create standard hunt templates
|-- Document SOPs for analysts
|
v
END: Velociraptor Operational at Scale