mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
80 lines
1.6 KiB
Markdown
80 lines
1.6 KiB
Markdown
# Forensic Timeline Investigation Report Template
|
|
|
|
## Case Information
|
|
|
|
| Field | Details |
|
|
|-------|---------|
|
|
| Case ID | |
|
|
| Sketch Name | |
|
|
| Lead Investigator | |
|
|
| Date Started | |
|
|
| Timesketch Instance | |
|
|
| Number of Timelines | |
|
|
| Total Events Indexed | |
|
|
|
|
## Evidence Sources
|
|
|
|
| Timeline Name | Source Type | Host/System | Events | Time Range |
|
|
|--------------|------------|-------------|--------|------------|
|
|
| | Windows EVTX | | | |
|
|
| | Plaso Full | | | |
|
|
| | Cloud Logs | | | |
|
|
| | Network Logs | | | |
|
|
|
|
## Investigation Objectives
|
|
|
|
1. [ ] Determine initial access vector
|
|
2. [ ] Identify compromised accounts
|
|
3. [ ] Map lateral movement paths
|
|
4. [ ] Identify persistence mechanisms
|
|
5. [ ] Determine data access and exfiltration
|
|
6. [ ] Establish complete attack timeline
|
|
|
|
## Attack Timeline Summary
|
|
|
|
| Time (UTC) | Event | Source | Host | ATT&CK Technique | Tags |
|
|
|------------|-------|--------|------|-------------------|------|
|
|
| | | | | | |
|
|
|
|
## Key Findings
|
|
|
|
### Finding 1: [Title]
|
|
- **Timesketch Search:** `[query string]`
|
|
- **Events:** [count]
|
|
- **Time Range:** [start] to [end]
|
|
- **Description:** [analysis]
|
|
- **Impact:** [assessment]
|
|
|
|
## Analyzers Run
|
|
|
|
| Analyzer | Results | Findings |
|
|
|----------|---------|----------|
|
|
| Sigma Rules | | |
|
|
| Domain Analyzer | | |
|
|
| Chain of Events | | |
|
|
| Feature Extraction | | |
|
|
|
|
## Saved Views
|
|
|
|
| View Name | Query | Purpose |
|
|
|-----------|-------|---------|
|
|
| | | |
|
|
|
|
## IOC Summary
|
|
|
|
### IP Addresses
|
|
### Domains
|
|
### File Hashes
|
|
### User Accounts
|
|
|
|
## Recommendations
|
|
|
|
1.
|
|
2.
|
|
3.
|
|
|
|
## Appendix
|
|
- Timesketch sketch export
|
|
- Full query list
|
|
- Plaso parser configuration
|