Documentation
¶
Overview ¶
Package risk implements a lightweight attack-path risk prioritization engine. It operates on the existing asset graph (internal/graph) without modifying any rule or correlation logic. The analyzer detects predefined toxic combinations and scores them using additive component weights.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ExplainRisk ¶ added in v0.20.0
func ExplainRisk(r RiskFinding) string
ExplainRisk converts a RiskFinding into a structured, plain-English security explanation with four sections: Attack Path, What This Means, Why This Is Dangerous, and Recommended Actions.
The explanation is generated deterministically from the finding's Path and Score — no external AI service is called.
Types ¶
type RiskFinding ¶
type RiskFinding struct {
Title string `json:"title"`
Path []string `json:"path"`
Score int `json:"score"`
Severity string `json:"severity"`
Explanation string `json:"explanation"`
}
RiskFinding is a single detected high-risk attack path in the asset graph.
func AnalyzeTopRisks ¶
func AnalyzeTopRisks(g *graph.Graph) []RiskFinding
AnalyzeTopRisks walks g and returns one RiskFinding per detected toxic combination, ordered by score descending. Returns nil when g is nil.
Detected patterns:
P1 Internet → LB → Workload → Node score 70 HIGH P2 Internet → LB → Workload → IAMRole score 80 HIGH P3 Internet → LB → Workload → IAMRole → Cloud score 130 CRITICAL P4 Workload → Node → IAMRole score 70 HIGH
Source Files