anti 97c99a4e03 feat(ttp): rich ThreatActor STIX extensions via CustomExtension + CustomObject ...

- stix_custom.py: DecnetActorFingerprintExt (@CustomExtension) wrapping
  network_behavior (os_guess/hop_distance/tcp_fingerprint/timing_stats/
  phase_sequence/behavior_class/beacon fields/tool_guesses) and
  protocol_fingerprints (ja3_hashes/hassh_hashes/kex_order_raw/
  ssh_client_banners/tls_cert_sha256/payload_simhashes/c2_endpoints).
  XDecnetBehaveProfile (@CustomObject x-decnet-behave-profile) carrying
  full BEHAVE-SHELL observation envelopes + kd_digraph_simhash.
  FINGERPRINT_EXT_DEF singleton extension-definition SDO.
- Drop legacy flat x_decnet_ja3_hashes / x_decnet_hassh_hashes /
  x_decnet_c2_endpoints (pre-v1, no consumers).
- stix_export: _threat_actor() wired to behavior + observations;
  build_attacker_bundle/build_fleet_bundle grow observations parameter.
- Repo: list_observations_by_attacker + get_all_observations_for_export
  abstract + sqlmodel impl; all four export endpoints extended.
- 18 new tests; inter-DECNET round-trip (stix2.parse → typed objects)
  is the primary fidelity assertion.

2026-05-09 08:52:19 -04:00

..

agent

fix(types): T7 — eliminate all remaining 38 mypy errors; fix DeckyRow subscript in engine tests

2026-05-01 02:07:53 -04:00

artifacts

refactor(artifacts): extract shard-finder out of transcripts router

2026-05-08 18:49:11 -04:00

asn

fix(types): P1 — annotate ranges: list[Range] in geoip/rir and asn/iptoasn providers

2026-05-01 00:21:44 -04:00

bus

feat(correlation/attribution): substrate + idle handler (Phase 1)

2026-05-08 23:16:13 -04:00

canary

fix(types): T7 — eliminate all remaining 38 mypy errors; fix DeckyRow subscript in engine tests

2026-05-01 02:07:53 -04:00

cli

feat(deploy): wire attribution worker — CLI + systemd unit + registry

2026-05-09 02:31:59 -04:00

clustering

feat(ttp): fail-closed validation that lifter+UKC IDs resolve in ATT&CK bundle

2026-05-09 05:58:06 -04:00

collector

fix(profiler/behave_shell): tolerate non-UTF-8 bytes in shard reads

2026-05-08 22:52:46 -04:00

correlation

feat(correlation/attribution): cross-primitive multi-actor detection (Phase 5)

2026-05-09 02:18:42 -04:00

decky_io

feat(deckies): generic file drops on fleet + MazeNET deckies

2026-04-28 22:43:34 -04:00

engine

fix(types): T7 — eliminate all remaining 38 mypy errors; fix DeckyRow subscript in engine tests

2026-05-01 02:07:53 -04:00

fleet

fix(types): T3 — narrow str|None at 12 sites; fix LANRow/DeckyRow subscript in mutator tests

2026-05-01 02:18:53 -04:00

geoip

fix(types): P1 — annotate ranges: list[Range] in geoip/rir and asn/iptoasn providers

2026-05-01 00:21:44 -04:00

intel

feat(intel,ingester): mal_hash feed + observed_attachments table (DEBT-046)

2026-05-03 05:56:46 -04:00

logging

fix(types): P2 — wire _MixinBase + col() across sqlmodel_repo; suppress pydantic/SQLModel column typing false positives

2026-05-01 00:49:18 -04:00

mutator

fix(types): T7 — eliminate all remaining 38 mypy errors; fix DeckyRow subscript in engine tests

2026-05-01 02:07:53 -04:00

net

feat(net): stealth-egress httpx client factory

2026-04-26 04:59:34 -04:00

orchestrator

fix(types): T7 — eliminate all remaining 38 mypy errors; fix DeckyRow subscript in engine tests

2026-05-01 02:07:53 -04:00

prober

feat(prober,correlation): attacker fingerprint rotation detection (DEBT-032)

2026-05-03 05:12:51 -04:00

profiler

fix(behave_shell/F.0): tighten prompt detector — log lines ending in '>' no longer vote

2026-05-09 02:57:40 -04:00

realism

fix(types): T3 — narrow str|None at 12 sites; fix LANRow/DeckyRow subscript in mutator tests

2026-05-01 01:47:04 -04:00

services

chore(infra): pin Docker base images by digest (DEBT-023)

2026-05-03 04:38:39 -04:00

sniffer

feat(sniffer): ISN sequence classifier (reuses seq_class helper)

2026-04-26 20:30:24 -04:00

swarm

fix(types): T7 — eliminate all remaining 38 mypy errors; fix DeckyRow subscript in engine tests

2026-05-01 02:07:53 -04:00

tarpit

fix(types): T7 — eliminate all remaining 38 mypy errors; fix DeckyRow subscript in engine tests

2026-05-01 02:07:53 -04:00

templates

feat(profiler/behave_shell): G.0 intent lexicon + lexical counter pass

2026-05-08 16:27:25 -04:00

topology

chore(infra): pin Docker base images by digest (DEBT-023)

2026-05-03 04:38:39 -04:00

ttp

feat(ttp): rich ThreatActor STIX extensions via CustomExtension + CustomObject

2026-05-09 08:52:19 -04:00

updater

sec(updater): harden tarball extraction and verify sha256 before extract

2026-04-27 21:14:48 -04:00

vectorstore

fix(types): T1 — remove 15 stale type: ignore comments confirmed unused by mypy

2026-05-01 02:18:40 -04:00

web

feat(ttp): rich ThreatActor STIX extensions via CustomExtension + CustomObject

2026-05-09 08:52:19 -04:00

webhook

fix(types): T5 — narrow AsyncClient|None with inline if; rename loop variable t→task to avoid no-redef

2026-05-01 02:18:57 -04:00

__init__.py

merge: testing → main (reconcile 2-week divergence)

2026-04-28 18:36:00 -04:00

archetypes.py

refactor(ssh): consolidate real_ssh into ssh, remove duplication

2026-04-11 19:51:41 -04:00

composer.py

merge: testing → main (reconcile 2-week divergence)

2026-04-28 18:36:00 -04:00

config_ini.py

feat(config): add swarmctl-host to INI, env, CLI; drop hardcoded bind from systemd unit

2026-04-30 22:16:00 -04:00

config.py

merge: testing → main (reconcile 2-week divergence)

2026-04-28 18:36:00 -04:00

custom_service.py

Add per-service customization, stealth hardening, and BYOS support

2026-04-04 04:08:27 -03:00

distros.py

chore(infra): pin Docker base images by digest (DEBT-023)

2026-05-03 04:38:39 -04:00

env.py

fix(types): T3 — narrow str|None at 12 sites; fix LANRow/DeckyRow subscript in mutator tests

2026-05-01 02:18:53 -04:00

ini_loader.py

fix: align tests with model validation and API error reporting

2026-04-13 01:43:52 -04:00

models.py

chore(infra): pin Docker base images by digest (DEBT-023)

2026-05-03 04:38:39 -04:00

network.py

Merge branch 'merge-rehearsal' into dev

2026-05-01 02:27:20 -04:00

os_fingerprint.py

feat(os_fingerprint): Phase 2 — add icmp_ratelimit + icmp_ratemask sysctls

2026-04-10 16:41:23 -04:00

privdrop.py

merge: testing → main (reconcile 2-week divergence)

2026-04-28 18:36:00 -04:00

telemetry.py

fix(types): P2 — wire _MixinBase + col() across sqlmodel_repo; suppress pydantic/SQLModel column typing false positives

2026-05-01 00:49:18 -04:00