attackpath

package

v0.1.8 Latest Latest Go to latest Published: Aug 15, 2026 License: Apache-2.0 Imports: 12 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/KKloudTarus/synapse-ce

Links

Open Source Insights

Documentation ¶

Overview ¶

Package attackpath derives bounded, evidence-carrying paths from estate assets to findings.

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func SortPaths ¶

func SortPaths(paths []Path)

SortPaths applies the report ordering: risk first, then evidence quality and stable ID.

Types ¶

type AssetNode ¶

type AssetNode struct {
	Asset asset.Asset `json:"asset"`
}

type Binding ¶

type Binding struct {
	TenantID     shared.ID
	EngagementID shared.ID
	AssetID      shared.ID
	FindingID    shared.ID
	TargetKind   TargetKind
	Producer     shared.ID
	Provenance   shared.ID
	Confidence   asset.EdgeConfidence
}

type BoundReport ¶

type BoundReport struct {
	MaxLength       int           `json:"maxLength"`
	MaxPaths        int           `json:"maxPaths"`
	MaxDuration     time.Duration `json:"maxDuration"`
	Truncated       bool          `json:"truncated"`
	LengthHit       bool          `json:"lengthHit"`
	PathsHit        bool          `json:"pathsHit"`
	TargetPathsHit  bool          `json:"targetPathsHit"`
	FindingPathsHit bool          `json:"findingPathsHit"`
	WallClockHit    bool          `json:"wallClockHit"`
}

BoundReport identifies a normal, resource-bound partial traversal.

type EdgeEvidence ¶

type EdgeEvidence struct {
	Producer   shared.ID            `json:"producer"`
	Provenance shared.ID            `json:"provenance"`
	Confidence asset.EdgeConfidence `json:"confidence"`
}

type FindingInput ¶

type FindingInput struct {
	Target             FindingTarget               `json:"target"`
	Finding            finding.Finding             `json:"finding"`
	Reachability       judgment.ReachabilityState  `json:"reachability"`
	Tier               judgment.ReachabilityTier   `json:"tier"`
	Provenance         shared.ID                   `json:"provenance"`
	Confirmed          bool                        `json:"confirmed"`
	External           bool                        `json:"external"`
	ImportedProvenance *importedfinding.Provenance `json:"importedProvenance,omitempty"`
}

type FindingNode ¶

type FindingNode struct {
	Input FindingInput `json:"input"`
}

type FindingTarget ¶

type FindingTarget struct {
	ID   shared.ID  `json:"ID"`
	Kind TargetKind `json:"Kind"`
}

type Graph ¶

type Graph struct {
	TenantID shared.ID
	Assets   map[shared.ID]AssetNode
	Findings map[FindingTarget]FindingNode
	Edges    []LogicalEdge
}

func NewGraph ¶

func NewGraph(in Input) (*Graph, error)

func (*Graph) Traverse ¶

func (g *Graph) Traverse(ctx context.Context, q Query, limits Limits) (Result, error)

Traverse derives paths from exposure assets, or Query.Entrypoint when selected.

type Input ¶

type Input struct {
	TenantID shared.ID
	Assets   []asset.Asset
	Edges    []asset.Edge
	Bindings []Binding
	Findings []FindingInput
}

type Limits ¶

type Limits struct {
	MaxLength   int
	MaxPaths    int
	MaxDuration time.Duration
	Now         func() time.Time
}

Limits bounds traversal work. Now is injectable so deadline behavior is deterministic in tests.

type LogicalEdge ¶

type LogicalEdge struct {
	From     shared.ID      `json:"from"`
	To       shared.ID      `json:"to"`
	ToTarget TargetKind     `json:"toTargetKind,omitempty"`
	Kind     asset.EdgeKind `json:"kind"`
	Evidence []EdgeEvidence `json:"evidence"`
	Observed bool           `json:"observed"`
	Finding  bool           `json:"finding"`
}

type Node ¶

type Node struct {
	Asset   *AssetNode   `json:"asset,omitempty"`
	Finding *FindingNode `json:"finding,omitempty"`
}

func (Node) ID ¶

func (n Node) ID() shared.ID

type Path ¶

type Path struct {
	ID            string        `json:"id"`
	Nodes         []Node        `json:"nodes"`
	Steps         []Step        `json:"steps"`
	Edges         []LogicalEdge `json:"edges"`
	Uncertainties []Uncertainty `json:"uncertainties"`
	Confident     bool          `json:"confident"`
}

Path is a root-to-finding traversal result.

type Query ¶

type Query struct {
	Target        shared.ID
	Entrypoint    shared.ID
	Finding       shared.ID
	FindingTarget *FindingTarget
}

Query filters paths. All non-empty filters compose with AND.

type Result ¶

type Result struct {
	Paths  []Path      `json:"paths"`
	Bounds BoundReport `json:"bounds"`
}

Result is the sorted path set and any traversal bounds reached.

type Step ¶

type Step struct {
	From      shared.ID      `json:"from"`
	To        shared.ID      `json:"to"`
	ToTarget  TargetKind     `json:"toTargetKind,omitempty"`
	Kind      string         `json:"kind"`
	Evidence  []EdgeEvidence `json:"evidence"`
	Observed  bool           `json:"observed"`
	ToFinding bool           `json:"toFinding"`
}

Step is one ordered, evidence-carrying transition in a path.

type TargetKind ¶

type TargetKind string

const (
	TargetCanonical TargetKind = "canonical"
	TargetImported  TargetKind = "imported"
)

func (TargetKind) Valid ¶

func (k TargetKind) Valid() bool

type Uncertainty ¶

type Uncertainty string

Uncertainty identifies a fact preventing a path from being confident.

const (
	UncertaintyInferredEdge            Uncertainty = "inferred_edge"
	UncertaintyMissingReachability     Uncertainty = "missing_reachability"
	UncertaintyUnknownReachability     Uncertainty = "unknown_reachability"
	UncertaintyUnconfirmedReachability Uncertainty = "unconfirmed_reachability"
)

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL