mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
81 lines
2.2 KiB
Markdown
81 lines
2.2 KiB
Markdown
# Amazon GuardDuty API Reference
|
|
|
|
## GuardDuty CLI - Core Operations
|
|
|
|
```bash
|
|
# Enable GuardDuty
|
|
aws guardduty create-detector --enable \
|
|
--finding-publishing-frequency FIFTEEN_MINUTES \
|
|
--data-sources '{"S3Logs":{"Enable":true},"Kubernetes":{"AuditLogs":{"Enable":true}}}'
|
|
|
|
# Get detector ID
|
|
aws guardduty list-detectors --query 'DetectorIds[0]' --output text
|
|
|
|
# Get detector status
|
|
aws guardduty get-detector --detector-id $DETECTOR_ID
|
|
|
|
# Enable Runtime Monitoring
|
|
aws guardduty update-detector --detector-id $DETECTOR_ID \
|
|
--features '[{"Name":"RUNTIME_MONITORING","Status":"ENABLED","AdditionalConfiguration":[{"Name":"ECS_FARGATE_AGENT_MANAGEMENT","Status":"ENABLED"}]}]'
|
|
```
|
|
|
|
## Finding Management
|
|
|
|
```bash
|
|
# List findings by severity
|
|
aws guardduty list-findings --detector-id $DET \
|
|
--finding-criteria '{"Criterion":{"severity":{"Gte":7}}}' \
|
|
--sort-criteria '{"AttributeName":"severity","OrderBy":"DESC"}'
|
|
|
|
# Get finding details
|
|
aws guardduty get-findings --detector-id $DET --finding-ids id1 id2
|
|
|
|
# Archive findings
|
|
aws guardduty archive-findings --detector-id $DET --finding-ids id1
|
|
|
|
# Create suppression filter
|
|
aws guardduty create-filter --detector-id $DET \
|
|
--name "SuppressDevVPC" --action ARCHIVE \
|
|
--finding-criteria '{"Criterion":{"resource.instanceDetails.networkInterfaces.subnetId":{"Eq":["subnet-dev"]}}}'
|
|
```
|
|
|
|
## GuardDuty Finding Severity Levels
|
|
|
|
| Range | Level | Action |
|
|
|-------|-------|--------|
|
|
| 7.0 - 8.9 | HIGH | Immediate investigation |
|
|
| 4.0 - 6.9 | MEDIUM | Investigation within 24h |
|
|
| 1.0 - 3.9 | LOW | Review during business hours |
|
|
|
|
## Key Finding Type Prefixes
|
|
|
|
| Prefix | Source |
|
|
|--------|--------|
|
|
| `Recon:` | Reconnaissance activity |
|
|
| `UnauthorizedAccess:` | Credential or access abuse |
|
|
| `CryptoCurrency:` | Mining activity |
|
|
| `Trojan:` | Malware communication |
|
|
| `Impact:` | Resource abuse |
|
|
| `Exfiltration:` | Data theft |
|
|
| `Persistence:` | Backdoor/persistence |
|
|
|
|
## EventBridge Rule for GuardDuty
|
|
|
|
```json
|
|
{
|
|
"source": ["aws.guardduty"],
|
|
"detail-type": ["GuardDuty Finding"],
|
|
"detail": {
|
|
"severity": [{"numeric": [">=", 7]}]
|
|
}
|
|
}
|
|
```
|
|
|
|
## Threat Intel Set
|
|
|
|
```bash
|
|
aws guardduty create-threat-intel-set --detector-id $DET \
|
|
--name "CustomBadIPs" --format TXT \
|
|
--location s3://bucket/threat-ips.txt --activate
|
|
```
|