mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 00:23:15 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
5.7 KiB
5.7 KiB
Workflows - Rapid7 InsightVM Deployment
Workflow 1: InsightVM Deployment Pipeline
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐
│ Install Security │────>│ Deploy Scan │────>│ Pair Engines │
│ Console │ │ Engines │ │ with Console │
└──────────────────┘ └──────────────────┘ └──────────────────┘
│
┌────────────────────────────────────────────────┘
v
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐
│ Configure Scan │────>│ Set Up Credential│────>│ Create Sites & │
│ Templates │ │ Store │ │ Asset Groups │
└──────────────────┘ └──────────────────┘ └──────────────────┘
│
v
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐
│ Schedule Scans │────>│ Deploy Insight │────>│ Configure │
│ │ │ Agents │ │ Reports & Alerts │
└──────────────────┘ └──────────────────┘ └──────────────────┘
Workflow 2: Scan Execution Cycle
For each scheduled scan:
1. Console dispatches scan job to assigned Scan Engine
2. Engine performs host discovery (ARP, ICMP, TCP SYN)
3. Engine fingerprints OS and services on discovered hosts
4. Engine selects vulnerability checks based on fingerprint
5. If credentials configured: authenticate and perform local checks
6. Engine reports findings back to Console database
7. Console correlates with previous scan data (new/fixed/unchanged)
8. Console updates risk scores and remediation projects
9. Notifications sent for new critical/high findings
10. Dashboard and reports refreshed automatically
Workflow 3: Hybrid Scanning Strategy
┌─────────────────────────────────────────────────────┐
│ Enterprise Network │
├─────────────────────────────────────────────────────┤
│ │
│ ┌──────────────┐ Engine Scan ┌────────────────┐ │
│ │ Data Center │ <───────────── │ DC Scan Engine │ │
│ │ Servers │ └────────────────┘ │
│ └──────────────┘ │
│ │
│ ┌──────────────┐ Engine Scan ┌────────────────┐ │
│ │ DMZ Servers │ <───────────── │ DMZ Scan Engine│ │
│ └──────────────┘ └────────────────┘ │
│ │
│ ┌──────────────┐ Agent-Based ┌────────────────┐ │
│ │ Laptops / │ <───────────── │ Insight Agent │ │
│ │ Remote Users │ │ (on endpoint) │ │
│ └──────────────┘ └────────────────┘ │
│ │
│ ┌──────────────┐ Agent-Based ┌────────────────┐ │
│ │ Cloud VMs │ <───────────── │ Insight Agent │ │
│ │ (AWS/Azure) │ │ (on instance) │ │
│ └──────────────┘ └────────────────┘ │
│ │
│ All results ──> Security Console │
│ ──> Insight Platform (Cloud) │
└─────────────────────────────────────────────────────┘
Workflow 4: Remediation Tracking
| Phase | Action | Owner | Timeline |
|---|---|---|---|
| Discovery | Scan identifies vulnerability | InsightVM | Automated |
| Triage | Severity confirmed, assigned to team | Security Ops | 24 hours |
| Remediation | Patch/config change applied | IT Operations | Per SLA |
| Validation | Re-scan confirms fix | InsightVM | Next scan cycle |
| Closure | Remediation project updated | Security Ops | Automated |