anti acf8382bcf feat(profiler/behave_shell): G.4 operational.multi_actor_indicators ...

Compare median intra-command IATs of the two temporal halves of the
session. ≥ MULTI_ACTOR_HALF_MIN_COMMANDS (4) per half required;
relative delta > MULTI_ACTOR_HANDOFF_DELTA (0.5) → handoff_detected.

team_coordinated is Tier B (cross-session); never emitted from a
single session. Confidence 0.55 with both halves ≥ 8 commands; 0.40
otherwise.

2026-05-08 16:33:15 -04:00

..

behave_shell

feat(profiler/behave_shell): G.4 operational.multi_actor_indicators

2026-05-08 16:33:15 -04:00

__init__.py

feat: add behavioral profiler for attacker pattern analysis

2026-04-15 12:51:19 -04:00

behavioral.py

feat(sniffer): capture SSH client banner from TCP stream

2026-04-22 21:37:01 -04:00

classify.py

refactor(profiler): split behavioral.py into topical modules

2026-04-22 21:10:19 -04:00

fingerprint.py

feat(sniffer): ISN sequence classifier (reuses seq_class helper)

2026-04-26 20:30:24 -04:00

identity_rollup.py

feat(prober-cert): roll up fingerprints onto AttackerIdentity

2026-04-28 11:28:54 -04:00

phases.py

refactor(profiler): split behavioral.py into topical modules

2026-04-22 21:10:19 -04:00

timing.py

refactor(profiler): split behavioral.py into topical modules

2026-04-22 21:10:19 -04:00

tools.py

refactor(profiler): split behavioral.py into topical modules

2026-04-22 21:10:19 -04:00

worker.py

feat(profiler): backfill Credential.attacker_uuid on attacker upsert

2026-04-26 03:30:44 -04:00