mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
57 lines
2.9 KiB
Markdown
57 lines
2.9 KiB
Markdown
# Workflows - XM Cyber Attack Path Analysis
|
|
|
|
## Workflow 1: Continuous Exposure Management Lifecycle
|
|
|
|
```
|
|
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐
|
|
│ Define Critical │────>│ Deploy Sensors │────>│ Run Attack Graph │
|
|
│ Assets (Crown │ │ (On-prem + Cloud)│ │ Analysis │
|
|
│ Jewels) │ │ │ │ │
|
|
└──────────────────┘ └──────────────────┘ └──────────────────┘
|
|
│
|
|
┌────────────────────────────────────────────────┘
|
|
v
|
|
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐
|
|
│ Identify Choke │────>│ Prioritize │────>│ Remediate & │
|
|
│ Points │ │ Remediation │ │ Validate │
|
|
└──────────────────┘ └──────────────────┘ └──────────────────┘
|
|
│
|
|
v
|
|
┌──────────────────┐
|
|
│ Continuous │ (Loop back to Attack Graph Analysis)
|
|
│ Monitoring │
|
|
└──────────────────┘
|
|
```
|
|
|
|
## Workflow 2: Choke Point Remediation
|
|
|
|
```
|
|
For each identified choke point:
|
|
1. Document the entity (host, credential, misconfiguration)
|
|
2. Map all attack paths passing through this choke point
|
|
3. List all critical assets protected if choke point is fixed
|
|
4. Determine remediation action (patch, reconfig, credential rotation)
|
|
5. Estimate fix complexity (easy/moderate/complex)
|
|
6. Calculate risk reduction score (paths * assets / complexity)
|
|
7. Assign to remediation team with priority and SLA
|
|
8. After fix: re-run analysis to confirm path elimination
|
|
9. Document residual risk if paths still exist
|
|
```
|
|
|
|
## Workflow 3: Attack Path to Remediation Ticket
|
|
|
|
```
|
|
XM Cyber Finding:
|
|
"Cached Domain Admin credential on WORKSTATION-042
|
|
enables 47 attack paths to Domain Controller DC-01"
|
|
│
|
|
v
|
|
Remediation Ticket:
|
|
Priority: P1-Emergency
|
|
Title: "Remove cached DA cred on WORKSTATION-042"
|
|
Action: Clear credential cache, implement LAPS,
|
|
restrict DA logon to Tier 0 only
|
|
Impact: Eliminates 47 attack paths to DC-01
|
|
SLA: 48 hours
|
|
```
|