netmon

type Anomaly struct {
	Kind     AnomalyKind
	Severity engine.Severity
	Workload string
	Dest     string  // human destination summary, "" for workload-scoped anomalies
	Title    string  // one human line
	Detail   string  // why it fired
	Score    float64 // 0..1 confidence, deterministic
	Evidence map[string]string
}

type AnomalyKind string

type Capture struct {
	// PolicyMode describes what egress enforcement was in place when the capture
	// was taken ("none", "audit", "enforce"). Absent means unknown/none, which is
	// itself worth flagging.
	PolicyMode string     `json:"policy_mode,omitempty"`
	Workloads  []Workload `json:"workloads"`
	Flows      []Flow     `json:"flows"`
	DNS        []DNSEvent `json:"dns,omitempty"`
}

type DNSEvent struct {
	WorkloadID string   `json:"workload_id"`
	TSUnix     int64    `json:"ts_unix"`
	QName      string   `json:"qname"`
	QType      string   `json:"qtype"`           // A, AAAA, TXT, NULL, ...
	RCode      string   `json:"rcode,omitempty"` // NOERROR, NXDOMAIN, ...
	Answers    []string `json:"answers,omitempty"`
}

type DestStat struct {
	Key        string // FQDN:port when known, else IP:port
	Host       string // FQDN if known else IP
	FQDN       string
	IP         string
	Port       uint16
	Proto      Protocol
	Internal   bool
	IMDS       bool
	Count      int
	BytesTx    int64
	BytesRx    int64
	FirstTS    int64
	LastTS     int64
	Denied     int     // flows with a deny verdict
	Timestamps []int64 // per-connection timestamps, ascending — beaconing input
}

type Direction string

type EgressClass string

type EgressIntent struct {
	Dest       string
	Class      EgressClass
	Reasons    []string
	Count      int
	BytesTx    int64
	FQDN       string
	Confidence float64
}

type Endpoint struct {
	IP        string `json:"ip,omitempty"`
	Port      uint16 `json:"port,omitempty"`
	FQDN      string `json:"fqdn,omitempty"`
	Workload  string `json:"workload,omitempty"`
	Namespace string `json:"namespace,omitempty"`
}

type Flow struct {
	// WorkloadID links the flow to a Workload in the same Capture.
	WorkloadID string    `json:"workload_id"`
	TSUnix     int64     `json:"ts_unix"`
	Proto      Protocol  `json:"proto"`
	Direction  Direction `json:"direction"`
	Src        Endpoint  `json:"src"`
	Dst        Endpoint  `json:"dst"`
	BytesTx    int64     `json:"bytes_tx"`
	BytesRx    int64     `json:"bytes_rx"`
	Verdict    Verdict   `json:"verdict,omitempty"`
	// Process attribution (the eBPF forensic correlation we get from Phase 5).
	Process string `json:"process,omitempty"`
	PID     int    `json:"pid,omitempty"`
}

type FlowLog struct {
	Workload Workload
	Egress   []Flow
	Ingress  []Flow
	DNS      []DNSEvent
	// Dests aggregates egress by destination (FQDN-preferred key) in stable order.
	Dests []*DestStat
}

type LiveSource struct {
	// Iface optionally names the interface to attach to; unused until wired.
	Iface string
}

type Options struct {
	// Now is the reference time. Zero means "derive from the capture window",
	// which keeps analysis deterministic without any wall-clock read.
	Now time.Time

	// Beaconing.
	BeaconMinSamples int     // minimum connections to a dest before periodicity is meaningful
	BeaconMaxCV      float64 // max coefficient of variation of intervals to call it regular
	BeaconMaxBytes   int64   // per-connection byte ceiling; beacons are small

	// Exfiltration.
	ExfilMinBytes     int64   // total egress bytes to one external dest to flag volume exfil
	ExfilTxRxRatio    float64 // tx:rx ratio above which traffic is upload-heavy
	LowSlowMinBytes   int64   // cumulative bytes for low-and-slow
	LowSlowMinSpanSec int64   // minimum duration for low-and-slow

	// Lateral movement.
	LateralMinPeers int // distinct internal peers before fan-out is suspicious

	// DNS.
	DNSTunnelMinQueries int     // queries under one parent before tunnelling is considered
	DNSEntropyThreshold float64 // Shannon entropy (bits/char) above which a label looks generated
	DGAMinNXDomain      int     // NXDOMAIN responses before a DGA is considered

	// AI-age features (off by default).
	EnableAgentEgress bool // flag AI-agent workloads reaching unknown model/inference hosts
	EnableIntent      bool // cluster destinations into intended vs anomalous
	IntentMinCount    int  // connection count at/above which a dest is "intended" (baseline)
}

type Protocol string

type RecordedSource struct {
	// contains filtered or unexported fields
}

type Report struct {
	Logs      []*FlowLog
	Anomalies []Anomaly
}

type Source interface {
	// Capture collects the currently available events. It must respect ctx and
	// must not block indefinitely.
	Capture(ctx context.Context) (*Capture, error)
}

type Verdict string

type Workload struct {
	ID          string            `json:"id"`
	Name        string            `json:"name,omitempty"`
	Namespace   string            `json:"namespace,omitempty"`
	Labels      map[string]string `json:"labels,omitempty"`
	Kind        string            `json:"kind,omitempty"`
	HostNetwork bool              `json:"host_network,omitempty"`
}