analyzer

Documentation

Index

• func Analyze(events []types.SyscallEvent) (string, []types.SyscallEvent)
• func GenerateSummary(verdict string, events []types.SyscallEvent) *types.ReportSummary
• func SetSensitivePaths(patterns []string)

Functions

func Analyze

func Analyze(events []types.SyscallEvent) (string, []types.SyscallEvent)

Analyze determines a verdict based on captured events. Events matching known-benign patterns are filtered out first. Suspicious events are enriched with Category and Reason fields.

func GenerateSummary

func GenerateSummary(verdict string, events []types.SyscallEvent) *types.ReportSummary

GenerateSummary creates a human-readable summary from analyzed events.

func SetSensitivePaths

func SetSensitivePaths(patterns []string)

SetSensitivePaths configures the sensitive path patterns used by the analyzer to detect credential access via shell commands (e.g. "cat ~/.ssh/id_rsa").