mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 16:40:24 +00:00

Consolidate 22 sibling repos into layered organism structure

Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c

2026-06-10 06:53:01 +00:00

1.5 KiB

Raw Blame History

API Reference — Performing False Positive Reduction in SIEM

Libraries Used

csv: Parse SIEM alert export files (Splunk, QRadar, Sentinel)
collections.Counter: Aggregate alert patterns by rule, source, severity

CLI Interface

python agent.py analyze --csv alerts.csv [--threshold 5]
python agent.py tune --csv alerts.csv
python agent.py simulate --csv alerts.csv [--disable-rules "Rule A" "Rule B"] [--whitelist-sources 10.0.0.1]

Core Functions

`analyze_alerts(csv_file, threshold)` — Identify false positive patterns

Parses alert CSV, calculates per-rule FP rates, identifies noisy rules exceeding threshold. Returns: total alerts, FP count/rate, noisy rules ranked by FP rate, top FP sources.

`generate_tuning_recommendations(csv_file)` — Create tuning action plan

Maps FP rates to actions: DISABLE (>=90%), ADD_WHITELIST (>=70%), TUNE_THRESHOLD (>=50%), REVIEW (<50%).

`simulate_tuning_impact(csv_file, rules_to_disable, sources_to_whitelist)` — Model tuning changes

Calculates alert volume reduction and new FP rate after applying proposed rule disables and source whitelists.

Expected CSV Columns

rule_name / Rule / alert_name: Detection rule identifier
src_ip / source_ip / Source: Source IP address
status / Status / disposition: Alert disposition (false_positive, fp, closed_fp, benign)
severity / Severity: Alert severity level

FP Status Keywords

false_positive, fp, closed_fp, benign

Dependencies

No external packages — Python standard library only.

1.5 KiB Raw Blame History