mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-02 08:57:48 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
57 lines
2.4 KiB
Markdown
57 lines
2.4 KiB
Markdown
# API Reference: Investigating Insider Threat Indicators
|
|
|
|
## Splunk REST API (SIEM Queries)
|
|
|
|
| Endpoint | Method | Description |
|
|
|----------|--------|-------------|
|
|
| `/services/search/jobs` | POST | Submit SPL search for user activity timeline |
|
|
| `/services/search/jobs/{sid}/results` | GET | Retrieve search results for DLP and access data |
|
|
| `/services/saved/searches` | GET | List saved insider threat correlation searches |
|
|
|
|
## Microsoft Purview DLP API (Graph)
|
|
|
|
| Endpoint | Method | Description |
|
|
|----------|--------|-------------|
|
|
| `/security/alerts_v2` | GET | Retrieve DLP policy violation alerts |
|
|
| `/security/incidents` | GET | List incidents with insider threat classification |
|
|
| `/compliance/ediscovery/cases` | POST | Create eDiscovery case for evidence preservation |
|
|
|
|
## Microsoft Graph (O365 Activity)
|
|
|
|
| Endpoint | Method | Description |
|
|
|----------|--------|-------------|
|
|
| `/auditLogs/signIns` | GET | Query user sign-in logs with location and device |
|
|
| `/auditLogs/directoryAudits` | GET | Directory change audit (role assignments, group changes) |
|
|
| `/users/{id}/mailFolders/{id}/messages` | GET | Search mailbox for exfiltration via email |
|
|
|
|
## Key Libraries
|
|
|
|
- **splunk-sdk**: Python SDK for submitting SPL queries and retrieving results
|
|
- **msgraph-sdk**: Microsoft Graph API for O365 audit logs and DLP alerts
|
|
- **hashlib** (stdlib): SHA-256 hashing for chain-of-custody evidence integrity
|
|
- **csv** (stdlib): Parse exported DLP alert data and access logs
|
|
|
|
## Evidence Handling
|
|
|
|
| Function | Purpose |
|
|
|----------|---------|
|
|
| `hashlib.sha256()` | Generate file hash for chain-of-custody log |
|
|
| `json.dump()` | Serialize evidence metadata with timestamps |
|
|
| `os.path.getsize()` | Record evidence file sizes |
|
|
|
|
## Configuration
|
|
|
|
| Variable | Description |
|
|
|----------|-------------|
|
|
| `SPLUNK_HOST` | Splunk search head URL for REST API queries |
|
|
| `SPLUNK_TOKEN` | Bearer token for Splunk authentication |
|
|
| `GRAPH_CLIENT_ID` | Azure AD app registration for Graph API access |
|
|
| `GRAPH_TENANT_ID` | Azure AD tenant ID |
|
|
|
|
## References
|
|
|
|
- [Splunk REST API Reference](https://docs.splunk.com/Documentation/Splunk/latest/RESTREF)
|
|
- [Microsoft Purview DLP](https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp)
|
|
- [CISA Insider Threat Guide](https://www.cisa.gov/topics/physical-security/insider-threat-mitigation)
|
|
- [CERT Insider Threat Center](https://insights.sei.cmu.edu/library/common-sense-guide-to-mitigating-insider-threats/)
|