mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
59 lines
1.5 KiB
Markdown
59 lines
1.5 KiB
Markdown
# API Reference: Implementing Email Sandboxing with Proofpoint
|
|
|
|
## Proofpoint TAP SIEM API
|
|
|
|
```python
|
|
import requests
|
|
resp = requests.get(
|
|
"https://tap-api-v2.proofpoint.com/v2/siem/all",
|
|
auth=(principal, secret),
|
|
params={"sinceSeconds": 3600, "format": "json"})
|
|
data = resp.json()
|
|
# Keys: messagesDelivered, messagesBlocked, clicksPermitted, clicksBlocked
|
|
```
|
|
|
|
## TAP API Endpoints
|
|
|
|
| Endpoint | Description |
|
|
|----------|-------------|
|
|
| `/v2/siem/all` | All threat events |
|
|
| `/v2/siem/messages/blocked` | Blocked messages only |
|
|
| `/v2/siem/messages/delivered` | Delivered threats |
|
|
| `/v2/siem/clicks/blocked` | Blocked URL clicks |
|
|
| `/v2/siem/clicks/permitted` | Permitted URL clicks |
|
|
|
|
## Threat Categories
|
|
|
|
| Category | Description | Severity |
|
|
|----------|-------------|----------|
|
|
| Malware | Malicious attachment | CRITICAL |
|
|
| Phish | Credential harvesting | HIGH |
|
|
| Impostor | BEC/spoofing | HIGH |
|
|
| Spam | Unsolicited | LOW |
|
|
|
|
## URL Defense Configuration
|
|
|
|
```json
|
|
{
|
|
"url_defense": {
|
|
"rewrite_all_urls": true,
|
|
"real_time_scanning": true,
|
|
"sandbox_detonation": true,
|
|
"click_time_protection": true
|
|
}
|
|
}
|
|
```
|
|
|
|
## Splunk Integration
|
|
|
|
```spl
|
|
index=proofpoint sourcetype=tap:siem
|
|
| where classification="malicious"
|
|
| stats count by sender, threatType, subject
|
|
```
|
|
|
|
### References
|
|
|
|
- Proofpoint TAP API: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation
|
|
- Proofpoint Email Protection: https://www.proofpoint.com/us/products/email-security-and-protection
|