rulepack

Documentation

Overview

Package rulepack implements declarative, shareable detection rules (plan §14, killer feature #4 — Sigma-style shareability). Rules are JSON documents loadable at triage time (`--rules <dir>`); no code changes are needed to add org- or community-specific detections.

Rule inputs follow the whole-package contract: rules can match normalized event fields (command, summary) or raw artifact content (config, transcript). All matching is deterministic; matched VALUES from secret-like rules are never echoed into findings.

Index

• Constants
• func ATLASName(id string) string
• func Apply(packs []Pack, res *schema.Normalized, pkgDir string) ([]schema.Finding, error)
• func ValidATLAS(id string) bool
• type Match
• type Pack
  • func LoadDir(dir string) ([]Pack, error)
  • func LoadFile(path string) (*Pack, error)
• type Rule

Constants

const ATLASVersion = "5.6.0"

ATLASVersion is the ATLAS release the technique table was generated from.

Functions

func ATLASName

func ATLASName(id string) string

ATLASName returns the technique name for id, or "" when unknown.

func Apply

func Apply(packs []Pack, res *schema.Normalized, pkgDir string) ([]schema.Finding, error)

Apply evaluates packs against a normalized result + sealed package.

func ValidATLAS

func ValidATLAS(id string) bool

ValidATLAS reports whether id is a technique or sub-technique ID in the embedded MITRE ATLAS release (atlas_ids.go, regenerated by scripts/gen-atlas-ids.sh).

Types

type Match

type Match struct {
	Type     string   `json:"type"`
	Contains []string `json:"contains,omitempty"` // any-of, case-insensitive
	Regex    string   `json:"regex,omitempty"`
}

Match declares what a rule inspects.

type: "command"    — tool-call command lines (normalized events)
      "summary"    — event summaries
      "config"     — raw config-category artifact content
      "transcript" — raw agent_session / prompt_history content

type Pack

type Pack struct {
	Pack    string `json:"pack"`
	Version string `json:"version"`
	Rules   []Rule `json:"rules"`
}

Pack is a versioned collection of rules.

func LoadDir

func LoadDir(dir string) ([]Pack, error)

LoadDir loads and validates every *.json pack in dir.

func LoadFile

func LoadFile(path string) (*Pack, error)

LoadFile loads and validates one pack.

type Rule

type Rule struct {
	ID            string   `json:"id"`
	Title         string   `json:"title"`
	Description   string   `json:"description"`
	Severity      string   `json:"severity"`   // INFO|LOW|MEDIUM|HIGH|CRITICAL
	Confidence    string   `json:"confidence"` // low|medium|high
	Match         Match    `json:"match"`
	FalsePositive string   `json:"false_positive_notes"`
	References    []string `json:"references,omitempty"`
	MitreATLAS    string   `json:"mitre_atlas,omitempty"`
	MitreATTACK   string   `json:"mitre_attack,omitempty"`
	// contains filtered or unexported fields
}

Rule is one declarative detection.