Documentation
¶
Overview ¶
Package anomaly provides a lightweight, in-process behavioural anomaly detector that plugs into the audit-sink chain. It watches the stream of ledger events and emits structured slog warnings when a session's activity crosses configurable thresholds: contacting too many distinct network destinations, bursting shell executions, or accumulating denials. It keeps only small per-session summaries in memory and never blocks the caller, so it is safe to drop into auditsink.NewMulti alongside the real sinks.
Index ¶
Constants ¶
const ( // EnvMaxHosts caps distinct network destinations per session before a // novel-host anomaly fires. Default 20. EnvMaxHosts = "RUNEWARD_ANOMALY_MAX_HOSTS" // EnvExecBurst is the number of shell execs within Window that trips an // exec-burst anomaly. Default 30. EnvExecBurst = "RUNEWARD_ANOMALY_EXEC_BURST" // EnvWindow is the sliding window for exec-burst detection. Default 1m. EnvWindow = "RUNEWARD_ANOMALY_WINDOW" // EnvMaxDenies caps deny verdicts per session before a denial-spike // anomaly fires. Default 10. EnvMaxDenies = "RUNEWARD_ANOMALY_MAX_DENIES" )
Environment variables recognised by New, with their defaults.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Counts ¶
Counts is a snapshot of how many times each anomaly kind has fired (after rate limiting) since the detector was created.
type Detector ¶
type Detector struct {
// contains filtered or unexported fields
}
Detector inspects audit events and warns on anomalous per-session behaviour. It implements auditsink.Sink so it can be composed into auditsink.NewMulti. It is safe for concurrent use.
func New ¶
New returns a Detector with thresholds read from the environment, falling back to the documented defaults. A nil logger uses slog.Default.
Source Files