mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
48 lines
1.9 KiB
Python
48 lines
1.9 KiB
Python
#!/usr/bin/env python3
|
|
"""DLP Policy Analyzer - Analyzes DLP alert exports for policy tuning."""
|
|
|
|
import json, csv, sys, os
|
|
from collections import Counter
|
|
from datetime import datetime
|
|
|
|
|
|
def parse_dlp_alerts(csv_path: str) -> list:
|
|
alerts = []
|
|
with open(csv_path, "r", encoding="utf-8-sig") as f:
|
|
for row in csv.DictReader(f):
|
|
alerts.append({
|
|
"timestamp": row.get("Date", ""),
|
|
"user": row.get("User", ""),
|
|
"activity": row.get("Activity", ""),
|
|
"policy": row.get("Policy", ""),
|
|
"sit": row.get("Sensitive Info Type", ""),
|
|
"action": row.get("Action", ""),
|
|
"location": row.get("Location", ""),
|
|
"overridden": row.get("Override", "").lower() == "true",
|
|
})
|
|
return alerts
|
|
|
|
|
|
def analyze(alerts: list) -> dict:
|
|
return {
|
|
"total": len(alerts),
|
|
"by_policy": dict(Counter(a["policy"] for a in alerts).most_common(20)),
|
|
"by_user": dict(Counter(a["user"] for a in alerts).most_common(20)),
|
|
"by_activity": dict(Counter(a["activity"] for a in alerts).most_common(10)),
|
|
"by_sit": dict(Counter(a["sit"] for a in alerts).most_common(10)),
|
|
"override_rate": round(sum(1 for a in alerts if a["overridden"]) / max(len(alerts), 1) * 100, 2),
|
|
"blocked": sum(1 for a in alerts if "block" in a["action"].lower()),
|
|
}
|
|
|
|
|
|
if __name__ == "__main__":
|
|
if len(sys.argv) < 2:
|
|
print("Usage: python process.py <dlp_alerts.csv>")
|
|
sys.exit(1)
|
|
alerts = parse_dlp_alerts(sys.argv[1])
|
|
result = analyze(alerts)
|
|
out = os.path.join(os.path.dirname(sys.argv[1]) or ".", "dlp_analysis.json")
|
|
with open(out, "w") as f:
|
|
json.dump({"report_generated": datetime.utcnow().isoformat() + "Z", **result}, f, indent=2)
|
|
print(f"Total: {result['total']} | Blocked: {result['blocked']} | Override rate: {result['override_rate']}%")
|