anti bfb3edbd4a fix(ssh-capture): add ss-only attribution fallback ...

fuser and /proc fd walks race scp/wget/sftp — by close_write the writer
has already closed the fd, so pid-chain attribution always resolved to
unknown for non-interactive drops. Fall back to the ss snapshot: one
established session → ss-only, multiple → ss-ambiguous (still record
src_ip from the first, analysts cross-check concurrent_sessions).

2026-04-17 22:36:06 -04:00

..

capture.sh

fix(ssh-capture): add ss-only attribution fallback

2026-04-17 22:36:06 -04:00

decnet_logging.py

chore: update templates and development documentation

2026-04-15 12:51:22 -04:00

Dockerfile

feat(ssh): capture attacker-dropped files with session attribution

2026-04-17 22:20:05 -04:00

entrypoint.sh

feat(ssh): capture attacker-dropped files with session attribution

2026-04-17 22:20:05 -04:00