anti
c635478442
Sub-step preceding the rule-pack commits per TTP_TAGGING.md:2967. Adds the per-rule precision suite scaffolding under tests/ttp/rule_precision/: - conftest.py: precision_engine fixture (RuleEngine populated from ./rules/ttp/), corpus_loader (real → seed → empty fallback), precision_for() helper for TP/FP accounting. - _build_corpus.py: extractor for a real prod corpus pull. Mandatory --exclude-ip / DECNET_TTP_CORPUS_EXCLUDE_IPS — operator IPs never end up in the committed exclusion list. Pulls both 'command' and 'unknown_command' event types. - corpus/seed_*.jsonl: synthetic seed rows for each cohort so the harness exercises in clean checkouts. - corpus/*.jsonl (operator-built) is gitignored. - test_corpus_loads.py: sentinel that every seed file parses.
66 lines
1.4 KiB
Plaintext
66 lines
1.4 KiB
Plaintext
.venv/
|
|
.venv*/
|
|
.311/
|
|
.3[0-9][0-9]/
|
|
logs/
|
|
.claude/*
|
|
CLAUDE.md
|
|
__pycache__/
|
|
*.pyc
|
|
*.pyo
|
|
*.egg-info/
|
|
dist/
|
|
build/
|
|
decnet-compose.yml
|
|
# Per-topology compose fragments emitted by `decnet topology deploy`.
|
|
decnet-topology-*-compose.yml
|
|
# Docker build context cache.
|
|
.docker/
|
|
decnet-state.json
|
|
*.ini
|
|
decnet.log*
|
|
*.loggy
|
|
*.nmap
|
|
linterfails.log
|
|
webmail
|
|
windows1
|
|
*.db
|
|
*.db-shm
|
|
*.db-wal
|
|
decnet.*.log
|
|
# Rotated copies (logrotate appends .1, .2, .gz...) — the existing
|
|
# decnet.*.log glob doesn't catch the suffix.
|
|
decnet.*.log.*
|
|
decnet.json
|
|
.env*
|
|
.env.local
|
|
.coverage
|
|
.hypothesis/
|
|
profiles/*
|
|
tests/test_decnet.db*
|
|
|
|
# Nested git clone of the wiki — not a submodule, just a local
|
|
# working copy so we can edit docs without a full round-trip.
|
|
wiki-checkout/
|
|
|
|
# Scratch test/debug outputs that leak from saved `pytest > hang.log`
|
|
# or `pytest > schem` redirections.
|
|
hang.log
|
|
schem
|
|
*.pytest.log
|
|
|
|
# pydeps-style dependency graph dumps from local analysis runs.
|
|
deps.txt
|
|
|
|
# Node modules vendored under decnet/canary/ for the obfuscator helper.
|
|
# The package.json is the source of truth; modules are reinstalled at
|
|
# build/deploy time.
|
|
node_modules/
|
|
package-lock.json
|
|
|
|
# TTP rule-precision corpus pulled from prod sqlite. Real attacker
|
|
# payloads — operator-only artifact. The synthetic ``seed_*.jsonl``
|
|
# files alongside ARE committed and exercise the harness in CI.
|
|
tests/ttp/rule_precision/corpus/*.jsonl
|
|
!tests/ttp/rule_precision/corpus/seed_*.jsonl
|