rulepack

Documentation

Overview

Package rulepack implements declarative, shareable detection rules (plan §14, killer feature #4 — Sigma-style shareability). Rules are JSON documents loadable at triage time (`--rules <dir>`); no code changes are needed to add org- or community-specific detections.

Rule inputs follow the whole-package contract: rules can match normalized event fields (command, summary) or raw artifact content (config, transcript). All matching is deterministic; matched VALUES from secret-like rules are never echoed into findings.

Index

• func Apply(packs []Pack, res *schema.Normalized, pkgDir string) ([]schema.Finding, error)
• type Match
• type Pack
  • func LoadDir(dir string) ([]Pack, error)
  • func LoadFile(path string) (*Pack, error)
• type Rule

Functions

func Apply

func Apply(packs []Pack, res *schema.Normalized, pkgDir string) ([]schema.Finding, error)

Apply evaluates packs against a normalized result + sealed package.

Types

type Match

type Match struct {
	Type     string   `json:"type"`
	Contains []string `json:"contains,omitempty"` // any-of, case-insensitive
	Regex    string   `json:"regex,omitempty"`
}

Match declares what a rule inspects.

type: "command"    — tool-call command lines (normalized events)
      "summary"    — event summaries
      "config"     — raw config-category artifact content
      "transcript" — raw agent_session / prompt_history content

type Pack

type Pack struct {
	Pack    string `json:"pack"`
	Version string `json:"version"`
	Rules   []Rule `json:"rules"`
}

Pack is a versioned collection of rules.

func LoadDir

func LoadDir(dir string) ([]Pack, error)

LoadDir loads and validates every *.json pack in dir.

func LoadFile

func LoadFile(path string) (*Pack, error)

LoadFile loads and validates one pack.

type Rule

type Rule struct {
	ID            string   `json:"id"`
	Title         string   `json:"title"`
	Description   string   `json:"description"`
	Severity      string   `json:"severity"`   // INFO|LOW|MEDIUM|HIGH|CRITICAL
	Confidence    string   `json:"confidence"` // low|medium|high
	Match         Match    `json:"match"`
	FalsePositive string   `json:"false_positive_notes"`
	References    []string `json:"references,omitempty"`
	MitreATLAS    string   `json:"mitre_atlas,omitempty"`
	MitreATTACK   string   `json:"mitre_attack,omitempty"`
	// contains filtered or unexported fields
}

Rule is one declarative detection.