mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2.4 KiB
2.4 KiB
Workflows: Zero Trust DNS with NextDNS
Workflow 1: Initial NextDNS Deployment
Step 1: Create NextDNS Configuration Profile
- Sign up at nextdns.io
- Create configuration profile with unique ID
- Configure security settings (all threat protection enabled)
- Configure privacy settings (blocklists, native tracking)
- Set log retention policy
Step 2: Deploy to Network Infrastructure
- Configure router-level DNS (DoH/DoT)
- Block plaintext DNS (port 53) at firewall for bypass prevention
- Configure split DNS for internal domains
- Test resolution of allowed and blocked domains
Step 3: Deploy to Endpoints
- Install NextDNS CLI on managed endpoints
- Configure mobile devices via app or Private DNS
- Deploy MDM profile for iOS devices
- Verify per-device identification in NextDNS dashboard
Step 4: Monitor and Tune
- Review blocked domains for false positives
- Add necessary allowlist entries
- Monitor query patterns for anomalies
- Adjust blocklists based on organizational needs
Workflow 2: DNS Security Policy Enforcement
Step 1: Define DNS Security Policy
- Mandatory security protections (threat intel, DGA, NRD)
- Privacy protections (tracker blocking, telemetry)
- Compliance-specific blocking categories
- Exception handling process
Step 2: Block Plaintext DNS Bypass
- Firewall rule: Block outbound port 53 UDP/TCP
- Exception: Only NextDNS CLI or approved resolvers
- Block known DoH endpoints not managed by organization
- Disable browser-level DoH in favor of system DNS
Step 3: Implement Monitoring
- Set up API integration for log export
- Forward DNS logs to SIEM
- Create alerts for suspicious DNS patterns
- Monitor for DNS tunneling indicators
Workflow 3: Incident Response with DNS Logs
Step 1: Detect Suspicious Activity
- Alert on high-frequency queries to single domain
- Alert on queries to known C2 domains (auto-blocked)
- Alert on DGA-like domain patterns
- Alert on DNS tunneling indicators (high entropy, long subdomains)
Step 2: Investigate
- Query NextDNS API for device-level DNS logs
- Correlate blocked domains with threat intelligence
- Identify affected devices and users
- Determine scope of potential compromise
Step 3: Respond
- Add malicious domains to denylist for immediate blocking
- Isolate affected endpoints
- Update firewall rules as needed
- Document findings for incident report