mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00

Consolidate 22 sibling repos into layered organism structure

Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c

2026-06-10 06:53:01 +00:00

1.7 KiB

Raw Blame History

API Reference — Performing Linux Log Forensics Investigation

Libraries Used

re: Pattern matching for log entries (IPs, users, timestamps, suspicious commands)
gzip: Read compressed log files (.gz)
pathlib: File system operations
collections.Counter: Aggregate brute force IPs, command tags

CLI Interface

python agent.py auth --file /var/log/auth.log
python agent.py syslog --file /var/log/syslog
python agent.py history --file /home/user/.bash_history
python agent.py timeline --files /var/log/auth.log /var/log/syslog /var/log/kern.log

Core Functions

`analyze_auth_log(log_file)` — Authentication log analysis

Detects: failed logins, successful logins, sudo commands, SSH events. Identifies brute force suspects (>=5 failed attempts from same IP).

`analyze_syslog(log_file)` — System log anomaly detection

Flags: errors/critical messages, kernel anomalies (segfault, OOM, panic), cron jobs.

`analyze_command_history(history_file)` — Suspicious command detection

12 patterns: remote code execution (curl|sh), reverse shells, base64 decode, crontab modification, firewall flush, history clearing, destructive commands.

`timeline_analysis(log_files)` — Multi-source timeline reconstruction

Merges events from multiple log files sorted by timestamp. Supports syslog format (Mon DD HH:MM:SS) and ISO 8601.

Suspicious Command Tags

Tag	Pattern
REMOTE_CODE_EXECUTION	curl/wget piped to sh/bash
BASH_REVERSE_SHELL	/dev/tcp/ usage
NETCAT_LISTENER	nc -e/-l/-p
HISTORY_CLEAR	history -c
DESTRUCTIVE_COMMAND	rm -rf /

Dependencies

No external packages — Python standard library only.

1.7 KiB Raw Blame History