mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
1.8 KiB
1.8 KiB
API Reference: Log Analysis for Forensic Investigation
python-evtx Library
import Evtx.Evtx as evtx
with evtx.Evtx("Security.evtx") as log:
for record in log.records():
print(record.xml())
Key Windows Security Event IDs
| Event ID | Description | Forensic Value |
|---|---|---|
| 4624 | Successful logon | Track authentication patterns |
| 4625 | Failed logon | Brute force detection |
| 4648 | Explicit credentials | Lateral movement indicator |
| 4688 | Process creation | Command execution timeline |
| 4697 | Service installed | Persistence mechanism |
| 4698 | Scheduled task created | Persistence mechanism |
| 1102 | Audit log cleared | Anti-forensics detection |
Syslog Parsing
| Log File | Content | Key Events |
|---|---|---|
/var/log/auth.log |
SSH, sudo, su | Failed/successful SSH, privilege escalation |
/var/log/syslog |
General system | Service events, kernel messages |
/var/log/audit/audit.log |
auditd | File access, command execution |
Python Libraries
| Library | Version | Purpose |
|---|---|---|
python-evtx |
>=0.7 | Windows EVTX event log parsing |
csv |
stdlib | Log data export and normalization |
re |
stdlib | Syslog and access log parsing |
CLI Tools
| Tool | Command | Description |
|---|---|---|
| evtxexport | evtxexport Security.evtx |
Export EVTX to text |
| Chainsaw | chainsaw hunt <evtx_dir> -s sigma/ |
Sigma-based EVTX analysis |
| Hayabusa | hayabusa csv-timeline -d <evtx_dir> |
Fast EVTX timeline generator |
References
- python-evtx: https://github.com/williballenthin/python-evtx
- Chainsaw: https://github.com/WithSecureLabs/chainsaw
- Hayabusa: https://github.com/Yamato-Security/hayabusa
- Sigma rules: https://github.com/SigmaHQ/sigma