mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
93 lines
4.8 KiB
Markdown
93 lines
4.8 KiB
Markdown
# MISP Threat Intelligence Collection Workflows
|
|
|
|
## Workflow 1: Automated Feed Collection Pipeline
|
|
|
|
```
|
|
[Community Feeds] --> [MISP Feed Manager] --> [Event Creation] --> [Correlation Engine]
|
|
| | | |
|
|
v v v v
|
|
- CIRCL OSINT - Schedule fetch - Auto-tag with - Deduplicate
|
|
- Botvrij.eu - Parse formats TLP/PAP - Cross-reference
|
|
- abuse.ch - Validate IOCs - Set distribution - Cluster similar
|
|
- PhishTank - Filter warninglists - Publish/unpublish events
|
|
```
|
|
|
|
### Steps:
|
|
1. **Feed Registration**: Add feeds via UI or PyMISP API with source_format, URL, and headers
|
|
2. **Scheduled Fetch**: Configure cron job or MISP scheduler to pull feeds at intervals
|
|
3. **Parsing and Validation**: MISP parses feed content, validates IOC formats, checks against warninglists
|
|
4. **Event Generation**: Each feed pull creates or updates events with parsed attributes
|
|
5. **Correlation**: MISP correlates new attributes against existing data, identifying overlaps
|
|
6. **Distribution**: Events are distributed based on TLP and sharing group configurations
|
|
|
|
## Workflow 2: Manual Intelligence Collection
|
|
|
|
```
|
|
[Analyst Report] --> [Manual Event Creation] --> [Attribute Addition] --> [Enrichment]
|
|
|
|
|
v
|
|
[Galaxy Tagging]
|
|
|
|
|
v
|
|
[Publication]
|
|
```
|
|
|
|
### Steps:
|
|
1. **Event Creation**: Create event with descriptive info, date, distribution, TLP tag
|
|
2. **IOC Entry**: Add attributes (IP, domain, hash, URL) with correct category and type
|
|
3. **Object Construction**: Group related attributes into MISP objects (file, domain-ip, email)
|
|
4. **Galaxy Linking**: Link event to MITRE ATT&CK techniques, threat actor clusters, malware families
|
|
5. **Enrichment**: Use MISP modules (VirusTotal, Shodan, CIRCL PassiveDNS) to enrich attributes
|
|
6. **Review and Publish**: Analyst reviews, sets to_ids flags, publishes for community sharing
|
|
|
|
## Workflow 3: TAXII Feed Integration
|
|
|
|
```
|
|
[TAXII Server] --> [TAXII Client] --> [STIX Parser] --> [MISP Import] --> [Correlation]
|
|
```
|
|
|
|
### Steps:
|
|
1. **Discovery**: Query TAXII server discovery endpoint for available API roots
|
|
2. **Collection Enumeration**: List available collections and their metadata
|
|
3. **Object Retrieval**: Fetch STIX 2.1 objects from collections with pagination
|
|
4. **STIX-to-MISP Mapping**: Map STIX Indicator, Malware, Threat Actor to MISP event/attributes
|
|
5. **Import**: Create MISP events from STIX bundles
|
|
6. **Correlation**: Run correlation against existing MISP data
|
|
|
|
## Workflow 4: Instance Synchronization
|
|
|
|
```
|
|
[MISP Instance A] <--sync--> [MISP Instance B] <--sync--> [MISP Instance C]
|
|
| | |
|
|
v v v
|
|
[Org A Events] [Shared Events] [Org C Events]
|
|
```
|
|
|
|
### Steps:
|
|
1. **Server Registration**: Register remote MISP instance with URL, API key, organization
|
|
2. **Sync Configuration**: Set sync direction (push/pull), filter rules, preview mode
|
|
3. **Pull Sync**: Pull events from remote instance matching filter criteria
|
|
4. **Push Sync**: Push local events to remote instance based on distribution level
|
|
5. **Conflict Resolution**: Handle attribute conflicts with priority rules
|
|
6. **Audit Logging**: Log all sync activities for compliance and troubleshooting
|
|
|
|
## Workflow 5: IOC Export for Defensive Tools
|
|
|
|
```
|
|
[MISP Events] --> [Export Module] --> [Format Conversion] --> [Defensive Tool]
|
|
|
|
|
+--------+--------+
|
|
| | |
|
|
v v v
|
|
[Suricata] [Bro/Zeek] [SIEM]
|
|
Rules Intel CSV/JSON
|
|
```
|
|
|
|
### Steps:
|
|
1. **Filter Selection**: Select events by tag, date range, threat level, to_ids flag
|
|
2. **Format Selection**: Choose output format (Suricata, Snort, Bro/Zeek, CSV, STIX, OpenIOC)
|
|
3. **Rule Generation**: Generate IDS/IPS rules from network IOCs
|
|
4. **SIEM Export**: Export to CSV/JSON for SIEM ingestion (Splunk, Elastic, QRadar)
|
|
5. **Automation**: Set up ZMQ/Kafka publishing for real-time IOC distribution
|
|
6. **Feedback Loop**: Track hit counts on exported IOCs, feed back to MISP for scoring
|