Documentation
¶
Overview ¶
Package attacksim is the engine module wrapper around internal/attacksim. It runs the safe adversary-emulation harness and projects control GAPS (scenarios where no admission/detection control fired) into the Finding model, so a scan can answer "are our Phase 4/5 defenses actually working?". It is OFF BY DEFAULT and safe by construction: Analyze returns nothing unless the caller sets an explicit authorization acknowledgement in the target metadata, and the harness only evaluates inert scenario descriptors — it never executes anything.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Command ¶
Command runs `dsecrat validate [flags]`. Exit codes: 0 no gaps, 1 gaps found, 2 usage error, 3 refused (missing acknowledgement).
func Register ¶
Register adds the attack-sim module to the registry. The master agent calls this from modules.Default() during integration, so this package never edits the shared registry file (parallel-safe wiring — see SHARED_CONTRACT §2).
Registering the module is safe even though it performs adversary emulation: the module is inert unless a target explicitly carries the authorization acknowledgement in its metadata (see attacksim.go).
Types ¶
type Module ¶
type Module struct{}
Module is the attack-simulation / control-validation capability (CAPABILITY_SPEC domain 14, pentest/validation).
func (*Module) Analyze ¶
Analyze runs the harness ONLY when authorized. Absent the acknowledgement it returns nothing, so it is silent in ordinary scans. When authorized it emits a gating-neutral coverage summary plus one finding per control gap (and per regression when a baseline is supplied).
Source Files