Evidence-fidelity gating, wider Sigma coverage, collector/canary reliability - #63
Merged
Merged
Conversation
…y reliability Track 1 — evidence integrity: - Normalizer tags each event by source fidelity; process_creation rules now only accept real process-creation telemetry (Sysmon/EventChannel eventdata, auditd execve). full_log/decoder scrapes can no longer yield a false DETECTED. - Techniques with only low-fidelity events report NO_TELEMETRY, not MISSED. Track 2 — Sigma coverage: - Add |re (regex), numeric lt/lte/gt/gte, and keyword (full-text) identifiers. - Coerce non-string YAML scalars (ints/bools) in field values. Track 3 — reliability & scaling: - Wazuh collector adds a date pre-filter (reads only the day(s) a window spans) and enlarges the scan buffer so long archive events are not truncated. - Canary executes once then polls until a deadline (configurable Checker), replacing fixed-interval re-fires. Track 4 — tests & polish: - New tests for the previously untested canary and report packages, plus fidelity/regex/numeric/keyword/date-prefilter coverage. - HTML summary surfaces NO_TELEMETRY/INCONCLUSIVE; dry-run prints an unmistakable synthetic-pipeline banner. - README/CHANGELOG updated to match code (gofmt normalized two untouched files). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Four improvement tracks. Every package passes
go test;go vetandgofmtclean.Track 1 — Evidence integrity (headline)
The normalizer now tags each event by source fidelity, and
process_creationrules only accept genuine process-creation telemetry (Sysmon/EventChanneleventdata, auditdexecve). Command-output/metadata scrapes (full_log, decoder name) are tagged low-fidelity and can never produce a falseDETECTED— a log line that merely mentions a binary is no longer "proof" the process ran. Techniques whose collected events are all low-fidelity now reportNO_TELEMETRY(collection gap) instead ofMISSED(proven miss).Behavior change: the Linux canary (
echo+full_log) now correctly reports the pipeline as not healthy, since Linux has no real process-creation telemetry (already documented). Windows (realeventdata) and dry-run (synthetic top-level fields) are unaffected.Track 2 — Sigma coverage
re(regex), numericlt/lte/gt/gte, and keyword (full-text) search identifiers.EventID: 4688) coerced to string form.Track 3 — Reliability & scaling
Checker), replacing fixed-interval re-fires — and is now unit-testable.Track 4 — Tests & polish
canaryandreportpackages, plus fidelity/regex/numeric/keyword/date-prefilter coverage.NO_TELEMETRY/INCONCLUSIVE; dry-run/synthetic runs print an unmistakable banner.Note:
gofmt -wnormalized two untouched files (feed/emulation.go,server/server.go).🤖 Generated with Claude Code