mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2.8 KiB
2.8 KiB
STIX/TAXII Feed Integration Workflows
Workflow 1: TAXII Feed Consumption
[TAXII Discovery] --> [API Root Enumeration] --> [Collection Selection] --> [Object Polling]
|
v
[STIX Parsing] --> [IOC Extraction]
|
v
[SIEM/TIP Ingestion]
Steps:
- Discovery: Query TAXII server discovery endpoint for available API roots
- Root Enumeration: List available API roots and their supported features
- Collection Listing: Enumerate collections with read/write permissions
- Incremental Polling: Fetch new objects using added_after timestamp filter
- STIX Parsing: Deserialize JSON into typed STIX objects
- IOC Extraction: Extract indicators, observables, and relationships
- Platform Ingestion: Push to SIEM, MISP, or OpenCTI
Workflow 2: STIX Bundle Production
[IOC Sources] --> [Normalization] --> [STIX Object Creation] --> [Bundle Assembly]
|
v
[TAXII Publication]
Steps:
- Source Collection: Gather IOCs from internal analysis, feeds, incident response
- Normalization: Standardize IOC formats and remove duplicates
- Object Creation: Create STIX Indicators, Observables, and Relationships
- TLP Marking: Apply appropriate TLP marking definitions
- Bundle Assembly: Package objects into STIX 2.1 bundles
- TAXII Push: POST bundles to writable TAXII collections
Workflow 3: Multi-Feed Aggregation
[TAXII Feed A] --+
|--> [Deduplication] --> [Correlation] --> [Unified Store]
[TAXII Feed B] --+ |
| v
[STIX File C] ---+ [Dashboard/Alerts]
Steps:
- Feed Registration: Configure multiple TAXII and file-based STIX sources
- Parallel Polling: Poll all feeds concurrently with rate limiting
- Deduplication: Remove duplicate objects by STIX ID and modified timestamp
- Correlation: Link related objects across feeds via relationships
- Unified Storage: Store in MemoryStore, FileSystemStore, or database-backed store
- Output: Generate alerts, dashboards, or exports for downstream consumers