security

Documentation

Index

• func DefaultRulesYAML() ([]byte, error)
• func EvaluateJSONLWithEngine(db *sql.DB, path string, out io.Writer, engine Engine) error
• func EvaluateJSONLWithState(db *sql.DB, path string, out io.Writer) error
• func IsEnforcingDecision(decision string) bool
• func ReevaluateRun(db *sql.DB, runID string, engine Engine) (evaluated int, alerts int, err error)
• type Decision
• type DecisionRecord
  • func EvaluateAndPersist(db *sql.DB, event Event, rawPayload string) (DecisionRecord, error)
  • func EvaluateRuntimeEvent(db *sql.DB, eventID string) (DecisionRecord, bool, error)
  • func EvaluateRuntimeEventWithEngine(db *sql.DB, eventID string, engine Engine) (DecisionRecord, bool, error)
  • func ListDecisions(db *sql.DB, runID string) ([]DecisionRecord, error)
  • func PersistDecision(db *sql.DB, event Event, rawPayload string, decision Decision) (DecisionRecord, error)
  • func PersistDenyForEvent(db *sql.DB, eventID, ruleID, reason string) (DecisionRecord, error)
  • func PersistDenyForEventTx(tx *sql.Tx, eventID, ruleID, reason string) (DecisionRecord, error)
• type Engine
  • func DefaultEngine() Engine
  • func LoadEngine(path string) (Engine, error)
  • func (e Engine) Evaluate(event Event) Decision
• type Event
• type QueryRefs
• type ResponseActionRecord
  • func ListResponseActions(db *sql.DB, runID string) ([]ResponseActionRecord, error)
• type ResponseActionView
• type ResponseActionsReport
  • func BuildResponseActionsReport(db *sql.DB, runID string) (ResponseActionsReport, error)
• type RiskSignalRecord
  • func ListRiskSignals(db *sql.DB, runID string) ([]RiskSignalRecord, error)
• type RiskSignalView
• type RiskSignalsReport
  • func BuildRiskSignalsReport(db *sql.DB, runID string) (RiskSignalsReport, error)
• type Rule
  • func DefaultRules() []Rule
  • func (r Rule) Matches(event Event) bool
• type RuleFile
• type RuleMatch

Functions

func DefaultRulesYAML

func DefaultRulesYAML() ([]byte, error)

DefaultRulesYAML renders the built-in policy as an editable YAML rules file, so an operator can dump it, tune the allow/detect lists (e.g. which credential paths count as the agent's own infra vs an exfil target), and load it back via LoadEngine / `policy test --rules`.

func EvaluateJSONLWithEngine

func EvaluateJSONLWithEngine(db *sql.DB, path string, out io.Writer, engine Engine) error

func EvaluateJSONLWithState

func EvaluateJSONLWithState(db *sql.DB, path string, out io.Writer) error

func IsEnforcingDecision

func IsEnforcingDecision(decision string) bool

IsEnforcingDecision classifies recorded deny, quarantine and kill decisions. It does not execute an action or check an operating-system outcome. The compliance view uses this category independently of execution receipts.

func ReevaluateRun

func ReevaluateRun(db *sql.DB, runID string, engine Engine) (evaluated int, alerts int, err error)

ReevaluateRun re-runs the policy engine over a run's already-captured runtime events, replacing the derived security layer (policy_decisions -> risk_signals -> response_actions -> unified signals + their graph edges) with fresh verdicts from `engine`. The raw events are UNTOUCHED -- full observability is preserved; only the "what did policy conclude" layer is recomputed. Deterministic (no model, no sensor): same events + same rules = same result. Pairs with `policy rules` for an edit-rules -> replay-history workflow.

Replacement is transactional, including signals and policy counters; any failure keeps the previous analysis. It does NOT retroactively reset session/process status a prior enforce set -- those record what the earlier policy actually did.

Types

type Decision

type Decision struct {
	Decision string `json:"decision"`
	Reason   string `json:"reason"`
	RuleID   string `json:"rule_id,omitempty"`
	// Mode records whether the matched rule enforces ("enforce") or only
	// observes ("detect"). Intended is the action the rule WOULD take when it
	// runs in enforce mode, preserved even when a detect-mode match downgrades
	// the effective Decision to "audit" -- the compliance view needs it to show
	// "detected, would have killed" vs "detected and killed".
	Mode     string `json:"mode,omitempty"`
	Intended string `json:"intended_decision,omitempty"`
}

type DecisionRecord

type DecisionRecord struct {
	ID        string `json:"id"`
	EventID   string `json:"event_id"`
	RunID     string `json:"run_id"`
	SessionID string `json:"session_id"`
	RuleID    string `json:"rule_id"`
	Decision  string `json:"decision"`
	Reason    string `json:"reason"`
	CreatedAt string `json:"created_at"`
}

func EvaluateAndPersist

func EvaluateAndPersist(db *sql.DB, event Event, rawPayload string) (DecisionRecord, error)

func EvaluateRuntimeEvent

func EvaluateRuntimeEvent(db *sql.DB, eventID string) (DecisionRecord, bool, error)

func EvaluateRuntimeEventWithEngine

func EvaluateRuntimeEventWithEngine(db *sql.DB, eventID string, engine Engine) (DecisionRecord, bool, error)

func ListDecisions

func ListDecisions(db *sql.DB, runID string) ([]DecisionRecord, error)

func PersistDecision

func PersistDecision(db *sql.DB, event Event, rawPayload string, decision Decision) (DecisionRecord, error)

func PersistDenyForEvent

func PersistDenyForEvent(db *sql.DB, eventID, ruleID, reason string) (DecisionRecord, error)

PersistDenyForEvent attaches a deny policy decision -- plus its risk signal, response action, unified security signal, and graph edges -- to an already-stored runtime event, in the exact same verifiable chain the rule engine writes. It is for out-of-band enforcers (e.g. the endpoint egress blocker that DENIED a codebase upload the rule engine never saw): the block becomes a first-class risk -> response node attributed to the event's session/process, so it renders as one chain with the rest of the run.

func PersistDenyForEventTx

func PersistDenyForEventTx(tx *sql.Tx, eventID, ruleID, reason string) (DecisionRecord, error)

PersistDenyForEventTx participates in a caller-owned reanalysis transaction. Every projection is required; the caller must roll back on any error.

type Engine

type Engine struct {
	SecretPathPatterns []string
	Rules              []Rule
}

func DefaultEngine

func DefaultEngine() Engine

func LoadEngine

func LoadEngine(path string) (Engine, error)

func (Engine) Evaluate

func (e Engine) Evaluate(event Event) Decision

type Event

type Event struct {
	Source     string   `json:"source"`
	EventType  string   `json:"event_type"`
	RunID      string   `json:"run_id"`
	SessionID  string   `json:"session_id"`
	ToolCallID string   `json:"tool_call_id"`
	ProcessID  string   `json:"process_id"`
	SnapshotID string   `json:"snapshot_id"`
	DstIP      string   `json:"dst_ip"`
	Path       string   `json:"path"`
	Args       []string `json:"args"`
}

type QueryRefs

type QueryRefs struct {
	Drilldowns []string `json:"drilldowns"`
}

type ResponseActionRecord

type ResponseActionRecord struct {
	ID               string `json:"id"`
	RunID            string `json:"run_id"`
	SessionID        string `json:"session_id"`
	ProcessID        string `json:"process_id"`
	SnapshotID       string `json:"snapshot_id"`
	RiskSignalID     string `json:"risk_signal_id"`
	PolicyDecisionID string `json:"policy_decision_id"`
	ActionType       string `json:"action_type"`
	TargetType       string `json:"target_type"`
	TargetID         string `json:"target_id"`
	Status           string `json:"status"`
	ResultRef        string `json:"result_ref"`
	Payload          string `json:"payload"`
	CreatedAt        string `json:"created_at"`
}

func ListResponseActions

func ListResponseActions(db *sql.DB, runID string) ([]ResponseActionRecord, error)

type ResponseActionView

type ResponseActionView struct {
	Response ResponseActionRecord `json:"response"`
	Query    QueryRefs            `json:"query"`
}

type ResponseActionsReport

type ResponseActionsReport struct {
	SchemaVersion string               `json:"schema_version"`
	RunID         string               `json:"run_id,omitempty"`
	ResultSetID   string               `json:"result_set_id"`
	PageHash      string               `json:"page_hash"`
	Count         int                  `json:"count"`
	Responses     []ResponseActionView `json:"responses"`
}

func BuildResponseActionsReport

func BuildResponseActionsReport(db *sql.DB, runID string) (ResponseActionsReport, error)

type RiskSignalRecord

type RiskSignalRecord struct {
	ID                string `json:"id"`
	RunID             string `json:"run_id"`
	SessionID         string `json:"session_id"`
	ToolCallID        string `json:"tool_call_id"`
	ProcessID         string `json:"process_id"`
	SnapshotID        string `json:"snapshot_id"`
	EventID           string `json:"event_id"`
	PolicyDecisionID  string `json:"policy_decision_id"`
	SignalType        string `json:"signal_type"`
	Severity          string `json:"severity"`
	Reason            string `json:"reason"`
	RecommendedAction string `json:"recommended_action"`
	Payload           string `json:"payload"`
	CreatedAt         string `json:"created_at"`
}

func ListRiskSignals

func ListRiskSignals(db *sql.DB, runID string) ([]RiskSignalRecord, error)

type RiskSignalView

type RiskSignalView struct {
	Risk  RiskSignalRecord `json:"risk"`
	Query QueryRefs        `json:"query"`
}

type RiskSignalsReport

type RiskSignalsReport struct {
	SchemaVersion string           `json:"schema_version"`
	RunID         string           `json:"run_id,omitempty"`
	ResultSetID   string           `json:"result_set_id"`
	PageHash      string           `json:"page_hash"`
	Count         int              `json:"count"`
	Risks         []RiskSignalView `json:"risks"`
}

func BuildRiskSignalsReport

func BuildRiskSignalsReport(db *sql.DB, runID string) (RiskSignalsReport, error)

type Rule

type Rule struct {
	ID       string    `yaml:"id" json:"id"`
	Match    RuleMatch `yaml:"match" json:"match"`
	Decision string    `yaml:"decision" json:"decision"`
	Reason   string    `yaml:"reason" json:"reason"`
	// Mode is "enforce" (default when empty) or "detect". A detect rule records
	// the would-be decision as an audit signal but takes no kill/quarantine
	// action -- the run is observed, not blocked. This is what makes the
	// compliance view's "detected, not enforced" state real rather than cosmetic.
	Mode string `yaml:"mode,omitempty" json:"mode,omitempty"`
	// Controls are the compliance control IDs (e.g. ASI03, Q1) this rule maps
	// to. The detection engine treats them as opaque tags; the compliance layer
	// reads them to answer "which control is covered by which rule, and did it
	// fire". Custom YAML rules set this to map themselves onto a framework.
	Controls []string `yaml:"controls,omitempty" json:"controls,omitempty"`
}

func DefaultRules

func DefaultRules() []Rule

func (Rule) Matches

func (r Rule) Matches(event Event) bool

type RuleFile

type RuleFile struct {
	Rules []Rule `yaml:"rules"`
}

type RuleMatch

type RuleMatch struct {
	Source       string   `yaml:"source"`
	EventType    string   `yaml:"event_type"`
	DstIP        string   `yaml:"dst_ip"`
	PrivateCIDR  bool     `yaml:"private_cidr"`
	PathContains []string `yaml:"path_contains"`
	ArgsContains []string `yaml:"args_contains"`
}