mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2.7 KiB
2.7 KiB
Threat Intelligence Platform Evaluation API Reference
MISP REST API
# Get version
curl "https://misp.example.com/servers/getVersion.json" \
-H "Authorization: YOUR_API_KEY" -H "Accept: application/json"
# Search events
curl -X POST "https://misp.example.com/events/restSearch" \
-H "Authorization: YOUR_API_KEY" -H "Content-Type: application/json" \
-d '{"tags": ["apt28"], "limit": 50}'
# Export STIX 2.1
curl "https://misp.example.com/events/restSearch" \
-H "Authorization: YOUR_API_KEY" -H "Accept: application/json" \
-d '{"returnFormat": "stix2"}'
# Feed management
curl "https://misp.example.com/feeds/index.json" -H "Authorization: YOUR_API_KEY"
OpenCTI GraphQL API
# Get platform version
query { about { version } }
# Search indicators
query {
indicators(filters: { key: "pattern_type", values: ["stix"] }) {
edges { node { name pattern valid_from valid_until } }
}
}
# Get campaigns
query {
campaigns(first: 20, orderBy: created_at, orderMode: desc) {
edges { node { name first_seen last_seen objectLabel { value } } }
}
}
ThreatConnect REST API
# List indicators
curl "https://api.threatconnect.com/v3/indicators" \
-H "Authorization: TC <ACCESS_ID>:<HMAC_SIGNATURE>"
# Create indicator
curl -X POST "https://api.threatconnect.com/v3/indicators" \
-H "Content-Type: application/json" \
-d '{"type":"Host","hostName":"evil.example.com","rating":5,"confidence":80}'
TAXII 2.1 API
# Discovery
curl https://taxii.example.com/taxii2/ -H "Accept: application/taxii+json;version=2.1"
# Get API roots
curl https://taxii.example.com/api1/ -H "Accept: application/taxii+json;version=2.1"
# List collections
curl https://taxii.example.com/api1/collections/ -H "Accept: application/taxii+json;version=2.1"
# Get objects from collection
curl "https://taxii.example.com/api1/collections/{id}/objects/" \
-H "Accept: application/stix+json;version=2.1"
TIP Evaluation Criteria Weights
| Category | Criterion | Weight |
|---|---|---|
| Core | STIX 2.1 support | 10 |
| Core | REST API | 9 |
| Core | TAXII server | 8 |
| Core | TLP enforcement | 8 |
| Integration | SIEM integration | 9 |
| Integration | Feed ingestion | 8 |
| Integration | EDR integration | 7 |
| Operations | Sharing (ISAC) | 7 |
| Operations | Analyst workflow | 7 |
| Operations | Reporting | 6 |
Platform Comparison Matrix
| Feature | MISP | OpenCTI | ThreatConnect |
|---|---|---|---|
| License | Open Source | Open Source | Commercial |
| STIX 2.1 | Native | Native | Import/Export |
| TAXII 2.1 | Yes | Yes | Yes |
| ATT&CK | Plugin | Native | Module |
| Graph Viz | Basic | Advanced | Advanced |
| SOAR | API | Connectors | Playbooks |