mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
1.5 KiB
1.5 KiB
API Reference: Implementing Endpoint DLP Controls
Sensitive Data Patterns
| Pattern | Regex | Severity |
|---|---|---|
| SSN | \d{3}-\d{2}-\d{4} |
HIGH |
| Credit Card | 4[0-9]{12}(?:[0-9]{3})? |
HIGH |
| AWS Key | AKIA[0-9A-Z]{16} |
CRITICAL |
| Private Key | -----BEGIN.*PRIVATE KEY----- |
CRITICAL |
| API Key | api[_-]?key\s*[:=]\s*[a-zA-Z0-9]{20,} |
HIGH |
DLP Channels
| Channel | Monitoring Method |
|---|---|
| USB/Removable | Device event logs |
| Cloud Storage | URL/domain filtering |
| Attachment scanning | |
| Clipboard | Process monitoring |
| Print spooler events |
Microsoft Purview DLP API
import requests
headers = {"Authorization": "Bearer <token>"}
resp = requests.get(
"https://graph.microsoft.com/v1.0/security/alerts_v2",
headers=headers,
params={"$filter": "category eq 'DataLossPrevention'"})
CrowdStrike Falcon DLP
curl -X GET "https://api.crowdstrike.com/dlp/entities/policies/v1" \
-H "Authorization: Bearer $TOKEN"
File Scanning
from pathlib import Path
import re
SENSITIVE_EXTS = {".pem", ".key", ".env", ".kdbx", ".pfx"}
for f in Path("/data").rglob("*"):
if f.suffix in SENSITIVE_EXTS or re.search(r"AKIA", f.read_text()):
print(f"ALERT: {f}")
References
- Microsoft Purview DLP: https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp
- CrowdStrike Falcon DLP: https://www.crowdstrike.com/platform/data-protection/