mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2.2 KiB
2.2 KiB
Snort IDS API Reference
Snort 3 CLI
# Validate configuration
snort -c /usr/local/etc/snort/snort.lua --daq-dir /usr/local/lib/daq -T
# Run IDS mode on interface
snort -c /usr/local/etc/snort/snort.lua --daq-dir /usr/local/lib/daq -i eth1 -l /var/log/snort -D
# Analyze PCAP file
snort -c /usr/local/etc/snort/snort.lua -r capture.pcap -l /var/log/snort/test/ -A fast
# Show version
snort -V
# Dump parsed rules count
snort -c /usr/local/etc/snort/snort.lua --daq-dir /usr/local/lib/daq -T 2>&1 | grep "rules loaded"
Snort Rule Syntax
action protocol src_ip src_port -> dst_ip dst_port (options;)
# Actions: alert, log, pass, drop, reject, sdrop
# Protocols: tcp, udp, icmp, ip
# Example rule
alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (
msg:"SMB exploit attempt";
flow:established,to_server;
content:"|FF|SMB";
content:"|25 00|"; distance:0; within:2;
sid:1000010; rev:1;
classtype:attempted-admin;
priority:1;
)
Rule Options
| Option | Description | Example |
|---|---|---|
content |
Match byte sequence | content:"admin"; |
nocase |
Case-insensitive match | content:"GET"; nocase; |
depth |
Limit search depth | depth:5; |
offset |
Start search at offset | offset:4; |
distance |
Bytes between matches | distance:0; |
within |
Max bytes for match | within:10; |
flow |
Flow direction | flow:established,to_server; |
threshold |
Rate limiting | threshold:type both, track by_src, count 10, seconds 60; |
sid |
Signature ID | sid:1000001; |
classtype |
Alert classification | classtype:trojan-activity; |
PulledPork 3 CLI
# Fetch and process rules
pulledpork3 -c /usr/local/etc/pulledpork3/pulledpork.conf
# Verify rule download
pulledpork3 -c /usr/local/etc/pulledpork3/pulledpork.conf -P
DAQ Module Configuration (Lua)
daq = {
module_dirs = { '/usr/local/lib/daq' },
modules = {
{ name = 'afpacket', variables = { 'buffer_size_mb=256' } }
}
}
Suppress / Threshold Syntax
suppress gen_id 1, sig_id 2100498, track by_src, ip 10.10.1.100
event_filter gen_id 1, sig_id 1000004, type limit, track by_src, count 5, seconds 3600