internal/

Package aggregate provides per-IP sliding-window event aggregation.

Package ai implements AI providers for EzyShield's threat analysis pipeline.

Package bench runs the full detection pipeline (parse → aggregate → rules → decision, dry-run) over a labeled corpus of attack and legitimate traffic (issue #216), turning "it detects brute force" into published, regression-guarded numbers: detection rate, false positives, and time-to-first-strike.

Package botverify implements forward-confirmed reverse DNS (FCrDNS) validation for well-known crawlers (issue #215).

Package cdndetect resolves domain names and classifies the resulting IP addresses against a compile-time embedded table of CDN edge ranges.

Package collector provides log collectors that implement sdk.Collector.

Package config provides YAML loading and strict validation for ezyshield configuration files.

Package daemon wires all EzyShield subsystems into the long-running watch daemon and exposes a unix-socket control API.

Package dashboard implements the localhost-only web UI for EzyShield.

Package decision is the safety-critical policy engine that converts Verdicts into enforceable Actions.

Package enforce implements sdk.Enforcer backed by nftables.

Package enrich provides O(1) GeoIP/ASN lookups via MaxMind MMDB files.

Package feeds downloads and parses IP reputation feeds (issue #194): Spamhaus DROP, FireHOL, AbuseIPDB plain exports, and anything else that is one IP or CIDR per line over HTTPS.

Package httpx holds small HTTP helpers shared across packages whose behavior is security-sensitive enough that duplication would be a risk.

Package metrics implements process-lifetime counters/gauges and Prometheus text exposition (issue #183) with zero dependencies — the text format is a few lines of writer code, which is exactly why no client library is worth its transitive weight in a security daemon.

Package migrate reads other ban tools' configurations so EzyShield can propose an equivalent setup.

Package nftnames is the single source of truth for the nftables table and set names EzyShield enforces into (issue #268).

Package notify fans-out alert messages to configured notification channels (Telegram, email, ...) with per-channel rate limiting and a global dedup window.

Package ownership centralizes the EzyShield daemon's unix group and the socket group-ownership logic shared by the daemon and the privileged enforcer.

Package parser provides log parsers that convert raw log lines into structured Events.

Package rules provides the always-available rule-based verdict engine.

Package scan discovers listening TCP sockets via /proc/net/tcp[6], maps each to its owning process / systemd unit / container, and resolves a log source.

Package siem renders EzyShield audit events into the wire formats that security information and event management systems (Wazuh, Splunk, generic syslog collectors) ingest natively: JSON, ArcSight CEF, and RFC 5424 structured-data syslog.

Package store provides the SQLite persistence layer for EzyShield.

Package update implements EzyShield's self-update logic: fetching releases from GitHub, verifying SHA256 checksums against checksums.txt, and atomically replacing the on-disk binaries.

Package vhostdetect enumerates virtual-host domains served by local reverse-proxy setups so the init wizard can offer to configure the matching edge enforcer.

Package webshell implements the webshell-drop tripwire (issue #221): a filesystem watch over configured web roots for new or modified files with executable web extensions — the artifact a log parser can never see when an upload bypassed the logs.