mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 00:23:15 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2.5 KiB
2.5 KiB
Zeek Network Anomaly Detection API Reference
Zeek CLI
# Process PCAP file
zeek -r capture.pcap -C
# Run on live interface
zeek -i eth1
# Run with custom script
zeek -r capture.pcap local.zeek
# ZeekControl
zeekctl deploy # Deploy and start
zeekctl status # Check status
zeekctl stop # Stop all workers
zeekctl diag # Diagnostics
Zeek Log Files
| Log | Content | Key Fields |
|---|---|---|
conn.log |
All connections | ts, id.orig_h, id.resp_h, service, duration |
dns.log |
DNS queries/responses | query, qtype_name, rcode_name |
ssl.log |
TLS handshakes | server_name, ja3, validation_status |
http.log |
HTTP requests | method, host, uri, user_agent |
files.log |
File transfers | md5, sha1, mime_type, filename |
notice.log |
Zeek notices/alerts | note, msg, src, dst |
weird.log |
Protocol anomalies | name, addl |
x509.log |
Certificate details | san.dns, certificate.not_valid_after |
Zeek Scripting - Custom Detection
# Detect DNS tunneling (long queries)
event dns_request(c: connection, msg: dns_msg, query: string, qtype: count, qclass: count) {
if (|query| > 60) {
NOTICE([$note=DNS::Tunneling,
$conn=c,
$msg=fmt("Long DNS query (%d chars): %s", |query|, query),
$identifier=cat(c$id$orig_h)]);
}
}
# Detect C2 beaconing
@load base/frameworks/sumstats
event connection_established(c: connection) {
if (Site::is_local_addr(c$id$orig_h) && !Site::is_local_addr(c$id$resp_h)) {
SumStats::observe("ext_conns",
SumStats::Key($str=cat(c$id$orig_h, "->", c$id$resp_h)),
SumStats::Observation($num=1));
}
}
Zeek Log Parsing (Python)
# Parse tab-separated Zeek logs
with open("conn.log") as f:
for line in f:
if line.startswith("#"):
continue
fields = line.strip().split("\t")
ts, uid, orig_h, orig_p, resp_h, resp_p = fields[:6]
zeek-cut (CLI field extraction)
# Extract specific fields
cat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p service
# DNS queries sorted by count
cat dns.log | zeek-cut query | sort | uniq -c | sort -rn | head -20
# JA3 fingerprints
cat ssl.log | zeek-cut ja3 server_name | sort | uniq -c | sort -rn
Beaconing Detection Formula
interval_avg = mean(connection_intervals)
jitter = mean(|interval - interval_avg|) / interval_avg
if jitter < 0.15 and connections > 10:
flag as potential C2 beacon