mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
48 lines
1.7 KiB
Markdown
48 lines
1.7 KiB
Markdown
# API Reference: Zero Trust for SaaS Applications
|
|
|
|
## Microsoft Graph API v1.0
|
|
|
|
### Authentication
|
|
```python
|
|
POST https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token
|
|
Body: grant_type=client_credentials&client_id=X&client_secret=Y&scope=https://graph.microsoft.com/.default
|
|
```
|
|
|
|
### Conditional Access
|
|
| Method | Endpoint | Description |
|
|
|--------|----------|-------------|
|
|
| GET | `/identity/conditionalAccess/policies` | List CA policies |
|
|
| GET | `/identity/conditionalAccess/policies/{id}` | Get policy details |
|
|
|
|
### Enterprise Applications
|
|
| Method | Endpoint | Description |
|
|
|--------|----------|-------------|
|
|
| GET | `/servicePrincipals` | List service principals |
|
|
| GET | `/oauth2PermissionGrants` | List OAuth consent grants |
|
|
| GET | `/appRoleAssignments` | List app role assignments |
|
|
|
|
### Identity Protection
|
|
| Method | Endpoint | Description |
|
|
|--------|----------|-------------|
|
|
| GET | `/identityProtection/riskyUsers` | List at-risk users |
|
|
| GET | `/identityProtection/riskDetections` | Risk detection events |
|
|
|
|
### CA Policy Grant Controls
|
|
| Control | Description |
|
|
|---------|-------------|
|
|
| `mfa` | Require multi-factor authentication |
|
|
| `compliantDevice` | Require Intune-compliant device |
|
|
| `domainJoinedDevice` | Require hybrid Azure AD join |
|
|
| `passwordChange` | Force password change |
|
|
|
|
### Risky OAuth Scopes
|
|
| Scope | Risk |
|
|
|-------|------|
|
|
| `Mail.ReadWrite` | Full mailbox access |
|
|
| `Files.ReadWrite.All` | All OneDrive/SharePoint files |
|
|
| `Directory.ReadWrite.All` | Full directory modification |
|
|
|
|
## References
|
|
- Graph API: https://learn.microsoft.com/en-us/graph/api/overview
|
|
- Conditional Access: https://learn.microsoft.com/en-us/entra/identity/conditional-access/
|