netdest

Documentation

Overview

Package netdest extracts network destinations from agent-invoked shell commands so timeline, exports and detections can reason about where an agent reached out to. Deterministic regex extraction; never resolves or contacts anything.

Index

• Variables
• func Extract(cmd string) []string
• func Host(dest string) string
• func IsAllowed(dest string, extra []string) bool
• func IsCloudMetadata(dest string) bool
• func IsUpload(cmd string) bool

Variables

var DefaultAllowlist = []string{
	"github.com", "api.github.com", "raw.githubusercontent.com", "objects.githubusercontent.com",
	"gitlab.com", "bitbucket.org",
	"pypi.org", "files.pythonhosted.org", "registry.npmjs.org", "npmjs.com", "yarnpkg.com",
	"proxy.golang.org", "sum.golang.org", "golang.org", "go.dev", "pkg.go.dev",
	"crates.io", "static.crates.io", "rubygems.org", "packagist.org",
	"docker.io", "registry-1.docker.io", "hub.docker.com", "ghcr.io", "quay.io",
	"localhost", "127.0.0.1", "0.0.0.0", "::1",
	"api.anthropic.com", "api.openai.com", "generativelanguage.googleapis.com",
	"deb.debian.org", "archive.ubuntu.com", "security.ubuntu.com", "dl.fedoraproject.org",
	"brew.sh", "formulae.brew.sh", "nodejs.org", "deno.land", "bun.sh",
}

DefaultAllowlist: destinations routinely contacted by legitimate development tooling. Rules treat anything else as "unexpected".

Functions

func Extract

func Extract(cmd string) []string

Extract returns unique destinations (host or host:port) referenced by a command line, in order of first appearance.

func Host

func Host(dest string) string

Host strips a port suffix.

func IsAllowed

func IsAllowed(dest string, extra []string) bool

IsAllowed reports whether a destination (or its parent domain) is in the allowlist.

func IsCloudMetadata

func IsCloudMetadata(dest string) bool

IsCloudMetadata flags the cloud instance-metadata endpoint — a classic credential-theft pivot inside cloud workloads.

func IsUpload

func IsUpload(cmd string) bool

IsUpload reports whether a command has upload/egress semantics.