Documentation
¶
Overview ¶
Command dsecrat-runtime is the runtime threat-detection daemon for the docker-security project. It is a separate binary from the main `dsecrat` scanner because it plays a different role: a node-resident sensor (DaemonSet-capable) that observes process/file/network/syscall telemetry and detects malicious behavior mapped to MITRE ATT&CK for Containers.
Today it ships with a fully working OFFLINE replay mode — feed it a recorded telemetry stream and it runs the exact deterministic detection engine a live node would, with response, forensics, incidents, and least-privilege profile generation. `run` attempts live capture by polling /proc, which is Linux-only; on other platforms (and anywhere /proc-based capture is unsupported) it fails cleanly and points you at replay mode instead.
Subcommands:
replay <scenario.json> detect over a recorded telemetry stream (offline) run watch the host live via /proc (Linux only) rules list the detection rule set and ATT&CK mapping version print sensor and rule-set versions
Source Files