mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00

Consolidate 22 sibling repos into layered organism structure

Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c

2026-06-10 06:53:01 +00:00

2.8 KiB

Raw Blame History

Alert Triage with Elastic SIEM - API Reference

elasticsearch-py Client

Connection

from elasticsearch import Elasticsearch
es = Elasticsearch(
    hosts=["https://elastic:9200"],
    api_key="base64-api-key",
    verify_certs=True
)

SIEM Signals Index

Elastic Security stores alerts in .siem-signals-<space>-* indices.

Querying Alerts

Search Open Alerts

es.search(
    index=".siem-signals-*",
    query={"bool": {"must": [
        {"range": {"@timestamp": {"gte": "now-24h"}}},
        {"term": {"signal.status": "open"}}
    ]}},
    sort=[{"@timestamp": {"order": "desc"}}],
    size=500
)

Alert Fields

Field	Path	Description
Rule name	`signal.rule.name`	Detection rule that triggered
Rule ID	`signal.rule.id`	Unique rule identifier
Severity	`signal.rule.severity`	critical, high, medium, low
Risk score	`signal.rule.risk_score`	0-100 numeric score
Status	`signal.status`	open, acknowledged, closed
Source IP	`source.ip`	Alert source address
Destination IP	`destination.ip`	Alert destination address
User	`user.name`	Associated username
Host	`host.name`	Affected hostname
Process	`process.name`	Triggering process

Aggregations

es.search(
    index=".siem-signals-*",
    query={"bool": {"must": [...]}},
    aggs={
        "by_severity": {"terms": {"field": "signal.rule.severity", "size": 10}},
        "by_rule": {"terms": {"field": "signal.rule.name.keyword", "size": 20}},
        "by_host": {"terms": {"field": "host.name.keyword", "size": 20}}
    },
    size=0
)

Alert Status Management

Update Alert Status

es.update(
    index=".siem-signals-default-000001",
    id="alert_doc_id",
    body={"doc": {"signal": {"status": "closed"}}}
)

Triage Prioritization

Severity Priority

Critical (risk score 90-100)
High (risk score 70-89)
Medium (risk score 40-69)
Low (risk score 0-39)

Alert Clustering

Alerts from the same host within a time window are grouped as potential incidents. Three or more alerts from the same host suggest a multi-stage attack.

Elastic Security API

List Detection Rules

GET /api/detection_engine/rules/_find?per_page=100

Get Rule Execution Status

GET /api/detection_engine/rules/_find_statuses

Output Schema

{
  "report": "elastic_siem_alert_triage",
  "total_open_alerts": 45,
  "severity_summary": {"critical": 3, "high": 12, "medium": 20, "low": 10},
  "alert_clusters": [{"host": "web01", "alert_count": 5, "max_severity": "high"}],
  "aggregations": {"by_severity": [{"key": "high", "count": 12}]}
}

CLI Usage

python agent.py --host https://elastic:9200 --api-key "key" --hours 24 --output report.json

2.8 KiB Raw Blame History