mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2.5 KiB
2.5 KiB
Cloud Incident Containment Workflows
Workflow 1: AWS Credential Compromise Response
START: Compromised AWS Credentials Detected
|
v
[Identify Scope]
|-- Which IAM user/role is compromised?
|-- What permissions does it have?
|-- Review CloudTrail for unauthorized actions
|
v
[Immediate Containment]
|-- Disable all access keys
|-- Attach deny-all inline policy
|-- Revoke active sessions (date condition)
|-- Update role trust policy if needed
|
v
[Evidence Preservation]
|-- Export CloudTrail logs to S3 with Object Lock
|-- Snapshot any accessed resources
|-- Document all API calls by compromised identity
|
v
[Impact Assessment]
|-- What resources were accessed?
|-- Was data exfiltrated?
|-- Were new resources created?
|-- Were other accounts compromised?
|
v
[Remediation]
|-- Rotate all credentials
|-- Remove unauthorized resources
|-- Update IAM policies
|-- Enable MFA enforcement
|
v
END: Containment Complete
Workflow 2: Cloud VM Compromise Response
START: Compromised Cloud VM Detected
|
v
[Preserve Evidence First]
|-- Create disk snapshot immediately
|-- Capture instance metadata
|-- Export relevant logs
|
v
[Network Isolation]
|-- Apply quarantine security group/NSG
|-- Remove public IP addresses
|-- Block outbound traffic
|-- Maintain forensic access only
|
v
[Assess Blast Radius]
|-- Check lateral movement indicators
|-- Review IAM role attached to instance
|-- Check for data access to other services
|
v
[Forensic Analysis]
|-- Mount snapshot to forensic workstation
|-- Analyze disk for malware/tools
|-- Review instance logs
|
v
[Recovery]
|-- Rebuild from known-good image
|-- Apply security hardening
|-- Restore from clean backup
|
v
END: VM Contained and Rebuilt
Workflow 3: Multi-Cloud Containment
START: Multi-Cloud Incident
|
v
[Identify Affected Cloud Platforms]
|-- AWS accounts affected?
|-- Azure subscriptions affected?
|-- GCP projects affected?
|
v
[Parallel Containment]
|-- AWS: SecurityHub + GuardDuty response
|-- Azure: Defender + Sentinel playbooks
|-- GCP: SCC + Chronicle response
|
v
[Cross-Cloud Credential Check]
|-- Shared credentials between platforms?
|-- Federated identity compromise?
|-- Third-party integrations affected?
|
v
[Unified Evidence Collection]
|-- Centralize logs from all platforms
|-- Normalize timestamps to UTC
|-- Build cross-cloud timeline
|
v
END: Multi-Cloud Containment Complete