feat(ttp): E.3.9 BehavioralLifter (R0031-R0040)

Reads pre-shaped session aggregates from TaggerEvent.payload and emits
techniques per Appendix A behavior tables. Per-rule predicates dispatch
on match.kind (lifter:behavioral_<name>); the lifter holds its own
RuleIndex watching the same RuleStore as the engine, so disable / clip /
TTL state reaches lifter-bound rules through the same atomic-swap path.

R0032/R0036/R0037/R0040 YAMLs had over-escaped regex strings (\\
instead of \\) — fixed in place.

Factory wired so default get_tagger() returns CompositeTagger with
BehavioralLifter shipped; remaining three lifters (E.3.10-E.3.12) land
in subsequent commits.

E.2.6 contract preserved via TolerantTagger: empty payload steady-state
yields [] with zero ERROR records. Disabled / clipped / expired state
verified.

This commit is contained in:

anti

2026-05-01 20:17:59 -04:00

parent 321ea7a2a6

commit eff3e4bce7

14 changed files with 759 additions and 52 deletions

									
										2

rules/ttp/R0040.yaml
									
												View File
												
				@@ -10,7 +10,7 @@ match:

				  kind: lifter:behavioral_tftp_router_config

				  filename_patterns:

				    - '.*-confg$'

				    - '.*\\.cfg$'

				    - '.*\.cfg$'

				    - 'startup-config'

				    - 'running-config'

				emits:

feat(ttp): E.3.9 BehavioralLifter (R0031-R0040)

2 rules/ttp/R0040.yaml Unescape Escape View File

2

rules/ttp/R0040.yaml

View File