mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 00:23:15 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2.4 KiB
2.4 KiB
AWS GuardDuty Findings Automation — API Reference
Libraries
| Library | Install | Purpose |
|---|---|---|
| boto3 | pip install boto3 |
AWS SDK for GuardDuty API |
Key boto3 GuardDuty Methods
| Method | Description |
|---|---|
list_detectors() |
List GuardDuty detector IDs |
get_detector(DetectorId=) |
Get detector configuration |
list_findings(DetectorId=, FindingCriteria=) |
Query finding IDs |
get_findings(DetectorId=, FindingIds=[]) |
Get finding details |
get_findings_statistics(DetectorId=) |
Finding counts by severity |
archive_findings(DetectorId=, FindingIds=[]) |
Archive processed findings |
list_members(DetectorId=) |
List member accounts (multi-account) |
create_sample_findings(DetectorId=) |
Generate sample findings for testing |
Finding Severity Levels
| Range | Level | Description |
|---|---|---|
| 7.0-8.9 | High | Compromised resource, active threat |
| 4.0-6.9 | Medium | Suspicious activity, potential threat |
| 1.0-3.9 | Low | Attempted suspicious activity |
GuardDuty Finding Types
| Type Prefix | Category |
|---|---|
Recon: |
Reconnaissance activity |
UnauthorizedAccess: |
Unauthorized access attempt |
CryptoCurrency: |
Crypto mining activity |
Trojan: |
Malware communication |
Stealth: |
Logging/monitoring evasion |
Policy: |
Policy violation |
Persistence: |
Persistence mechanism |
GuardDuty Protection Features
| Feature | Description |
|---|---|
| S3_DATA_EVENTS | S3 data plane monitoring |
| EKS_AUDIT_LOGS | EKS control plane monitoring |
| EBS_MALWARE_PROTECTION | EBS volume malware scanning |
| RDS_LOGIN_EVENTS | RDS login activity monitoring |
| LAMBDA_NETWORK_LOGS | Lambda function network monitoring |
| RUNTIME_MONITORING | EC2/ECS/EKS runtime threat detection |
FindingCriteria Filter
criteria = {
"Criterion": {
"severity": {"Gte": 7.0},
"service.archived": {"Eq": ["false"]},
"type": {"Eq": ["UnauthorizedAccess:EC2/SSHBruteForce"]},
}
}