Documentation
¶
Overview ¶
Package runtime is the engine-module face of the runtime sensor. It replays a recorded telemetry stream (the offline capture a node's dsecrat-runtime daemon produces) through the deterministic detection core in internal/runtime and projects the resulting detections into engine.Findings, so runtime threats appear in the same unified scan report as static findings.
It Supports container targets. The telemetry to analyze is supplied out-of-band (a recorded scenario file named in the target metadata, or inlined in the target content) — the module never touches a live kernel; that is the daemon's job on Linux. With no telemetry supplied the module is silent, so it never fabricates findings. The novel/behavioral detections stay off unless explicitly enabled via metadata, mirroring the core's off-by-default posture.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Register ¶
Register adds the runtime module to the registry. The master agent calls this from modules.Default() during integration, so this package never edits the shared registry file (parallel-safe wiring — see SHARED_CONTRACT §2).
Registering is safe: without runtime telemetry supplied in the target the module produces nothing, and the behavioral/agent rules stay off unless explicitly enabled via metadata.
Types ¶
type Module ¶
type Module struct{}
Module surfaces runtime detections in a scan report (CAPABILITY_SPEC domains 4 dynamic/behavior, 5 forensics, 11 detection/response).
func (*Module) Analyze ¶
Analyze loads the telemetry for the target, runs the deterministic detector, and projects detections into findings scoped to the target container. With no telemetry available it returns nothing (not an error) — a scan of a container for which we hold no runtime data simply has no runtime findings.
Source Files