Initial commit - 611 cybersecurity skills across all subdomains

2026-07-28 23:20:58 +03:00 · 2026-02-25 10:47:44 +01:00
commit 22a7ab1462
1765 changed files with 280648 additions and 0 deletions
@@ -0,0 +1,28 @@
+# Standards and Frameworks Reference
+
+## TIP Architecture Standards
+- **STIX 2.1**: Native data model for CTI representation
+- **TAXII 2.1**: Transport protocol for CTI sharing
+- **MITRE ATT&CK**: Technique taxonomy for TTP mapping
+- **Diamond Model**: Intrusion analysis framework
+- **Kill Chain**: Lockheed Martin Cyber Kill Chain for attack phase tracking
+
+## Platform Component Standards
+| Component | Protocol | Data Format |
+|-----------|----------|-------------|
+| MISP | REST API | MISP JSON, STIX 2.1 |
+| OpenCTI | GraphQL API | STIX 2.1 |
+| TheHive | REST API | TheHive JSON |
+| Cortex | REST API | Cortex Report JSON |
+| Elasticsearch | REST API | JSON |
+
+## Integration Standards
+- **MISP Sync Protocol**: Push/Pull over HTTPS with API key auth
+- **OpenCTI Connectors**: RabbitMQ-based message queue for async processing
+- **Cortex Analyzers**: Docker-based analyzers with standardized I/O
+- **SIEM Integration**: Syslog, Kafka, REST API, or file-based export
+
+## References
+- [OpenCTI Architecture](https://docs.opencti.io/latest/deployment/overview/)
+- [MISP Architecture](https://www.misp-project.org/features/)
+- [TheHive Documentation](https://docs.strangebee.com/)
@@ -0,0 +1,31 @@
+# TIP Architecture Workflows
+
+## Workflow 1: End-to-End Intelligence Pipeline
+```
+[External Feeds] --> [MISP] --> [OpenCTI] --> [Enrichment (Cortex)] --> [SIEM/TheHive]
+    |                   |            |                |                       |
+    v                   v            v                v                       v
+OSINT/Commercial   Correlate    Knowledge Graph   VT/Shodan/AIPDB    Alerts/Cases
+```
+
+## Workflow 2: Incident-to-Intelligence Feedback Loop
+```
+[SOC Alert] --> [TheHive Case] --> [Cortex Analysis] --> [IOC Extraction]
+                                                               |
+                                                               v
+                                                    [MISP Event Creation]
+                                                               |
+                                                               v
+                                                    [OpenCTI Knowledge Update]
+                                                               |
+                                                               v
+                                                    [Updated Detections --> SIEM]
+```
+
+## Workflow 3: Platform Health Monitoring
+```
+[Prometheus/Grafana] --> [Component Health] --> [Feed Status] --> [Alert on Failure]
+                              |                      |
+                              v                      v
+                     [ES Cluster Health]    [Connector Status]
+```