saint-graves/sica-fondt
1
0
Fork 0
mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
sica-fondt/knowledge/cyber-skills/skills/correlating-threat-campaigns/references/api-reference.md
Claude 24f816b6a3
Consolidate 22 sibling repos into layered organism structure 
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2026-06-10 06:53:01 +00:00

2.1 KiB
Raw Blame History

Threat Campaign Correlation API Reference

MISP REST API

# Search attributes
curl -X POST "https://misp.example.com/attributes/restSearch" \
  -H "Authorization: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"type": "ip-src", "value": "185.220.101.42"}'

# Search events by tag
curl -X POST "https://misp.example.com/events/restSearch" \
  -H "Authorization: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"tags": ["apt28", "fancy-bear"], "from": "2024-01-01"}'

# Get event with correlations
curl "https://misp.example.com/events/view/1234" \
  -H "Authorization: YOUR_API_KEY" -H "Accept: application/json"

# Add attribute to event
curl -X POST "https://misp.example.com/attributes/add/1234" \
  -H "Authorization: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"type": "ip-dst", "value": "203.0.113.50", "category": "Network activity", "to_ids": true}'

MISP Correlation Engine

Correlation Type Description
Attribute match Same value in multiple events
CIDR overlap IPs in same /24 or /16 subnet
Fuzzy hash (ssdeep) Similar malware samples
Over-correlation Common values excluded (CDN IPs)

OpenCTI GraphQL API

# Query campaign relationships
query {
  campaign(id: "campaign-uuid") {
    name
    first_seen
    last_seen
    objectsOfRelationship(relationship_type: "uses") {
      edges { node { ... on Malware { name } } }
    }
    objectsOfRelationship(relationship_type: "attributed-to") {
      edges { node { ... on IntrusionSet { name aliases } } }
    }
  }
}

STIX 2.1 Campaign Object

{
  "type": "campaign",
  "spec_version": "2.1",
  "id": "campaign--uuid",
  "name": "Operation ShadowStrike",
  "first_seen": "2024-01-15T00:00:00Z",
  "last_seen": "2024-06-30T00:00:00Z",
  "objective": "Data exfiltration from financial sector"
}

STIX Relationship Types

Type Source Target
attributed-to Campaign Threat Actor
uses Intrusion Set Malware / Tool
targets Campaign Identity / Sector
indicates Indicator Malware
related-to Any Any