mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
80 lines
2.2 KiB
Markdown
80 lines
2.2 KiB
Markdown
# API Reference: Building Incident Response Dashboard
|
|
|
|
## splunk-sdk (splunklib)
|
|
|
|
```python
|
|
import splunklib.client as client
|
|
import splunklib.results as results
|
|
|
|
service = client.connect(host="localhost", port=8089,
|
|
username="admin", password="changeme")
|
|
|
|
# Run a blocking search
|
|
job = service.jobs.create(
|
|
'search index=notable | stats count by urgency',
|
|
earliest_time="-24h", latest_time="now", exec_mode="blocking"
|
|
)
|
|
for result in results.JSONResultsReader(job.results(output_mode="json")):
|
|
print(result)
|
|
|
|
# Create a saved search (dashboard panel)
|
|
service.saved_searches.create("IR_Affected_Systems", search="""
|
|
search index=notable incident_id="IR-*"
|
|
| stats count by dest, urgency | sort - count
|
|
""")
|
|
```
|
|
|
|
## Key SPL Patterns for IR Dashboards
|
|
|
|
```spl
|
|
--- Incident summary single-value panels
|
|
| makeresults | eval status="CONTAINMENT", affected=7, contained=5
|
|
|
|
--- SOC Metrics (MTTD / MTTR)
|
|
index=notable status_label="Resolved*"
|
|
| eval mttr_hours = round((status_end - _time) / 3600, 1)
|
|
| stats avg(mttr_hours) AS avg_mttr by urgency
|
|
|
|
--- Analyst workload
|
|
index=notable earliest=-7d | stats count by owner | sort - count
|
|
|
|
--- IOC spread tracking
|
|
index=* (src_ip IN ("1.2.3.4") OR dest="evil.com")
|
|
| timechart span=1h count by sourcetype
|
|
|
|
--- Alert disposition
|
|
index=notable status_label="Closed*"
|
|
| stats count by disposition
|
|
| eventstats sum(count) AS total
|
|
| eval pct = round(count/total*100, 1)
|
|
```
|
|
|
|
## Dashboard Studio (Splunk v2)
|
|
|
|
```xml
|
|
<dashboard version="2" theme="dark">
|
|
<label>IR Dashboard</label>
|
|
<row>
|
|
<panel><title>Affected Systems</title>
|
|
<table><search><query>| inputlookup ir_systems.csv</query></search></table>
|
|
</panel>
|
|
</row>
|
|
</dashboard>
|
|
```
|
|
|
|
## TheHive API (Case Tracking)
|
|
|
|
```python
|
|
import requests
|
|
headers = {"Authorization": "Bearer <api_key>"}
|
|
# List open cases
|
|
resp = requests.get("http://thehive:9000/api/case",
|
|
headers=headers, params={"range": "0-50", "sort": "-startDate"})
|
|
```
|
|
|
|
### References
|
|
|
|
- splunk-sdk-python: https://github.com/splunk/splunk-sdk-python
|
|
- Splunk Dashboard Studio: https://docs.splunk.com/Documentation/DashboardStudio
|
|
- TheHive API: https://docs.strangebee.com/thehive/api-docs/
|