internal/

Package aggregate provides per-IP sliding-window event aggregation.

Package ai implements AI providers for EzyShield's threat analysis pipeline.

Package cdndetect resolves domain names and classifies the resulting IP addresses against a compile-time embedded table of CDN edge ranges.

Package collector provides log collectors that implement sdk.Collector.

Package config provides YAML loading and strict validation for ezyshield configuration files.

Package daemon wires all EzyShield subsystems into the long-running watch daemon and exposes a unix-socket control API.

Package dashboard implements the localhost-only web UI for EzyShield.

Package decision is the safety-critical policy engine that converts Verdicts into enforceable Actions.

Package enforce implements sdk.Enforcer backed by nftables.

Package enrich provides O(1) GeoIP/ASN lookups via MaxMind MMDB files.

Package nftnames is the single source of truth for the nftables table and set names EzyShield enforces into (issue #268).

Package notify fans-out alert messages to configured notification channels (Telegram, email, ...) with per-channel rate limiting and a global dedup window.

Package ownership centralizes the EzyShield daemon's unix group and the socket group-ownership logic shared by the daemon and the privileged enforcer.

Package parser provides log parsers that convert raw log lines into structured Events.

Package rules provides the always-available rule-based verdict engine.

Package scan discovers listening TCP sockets via /proc/net/tcp[6], maps each to its owning process / systemd unit / container, and resolves a log source.

Package siem renders EzyShield audit events into the wire formats that security information and event management systems (Wazuh, Splunk, generic syslog collectors) ingest natively: JSON, ArcSight CEF, and RFC 5424 structured-data syslog.

Package store provides the SQLite persistence layer for EzyShield.

Package update implements EzyShield's self-update logic: fetching releases from GitHub, verifying SHA256 checksums against checksums.txt, and atomically replacing the on-disk binaries.

Package vhostdetect enumerates virtual-host domains served by local reverse-proxy setups so the init wizard can offer to configure the matching edge enforcer.