DECNET

Files

anti bff03d1198 Add cross-decky correlation engine and decnet correlate command

When the same attacker IP touches multiple deckies, the engine builds a
chronological traversal graph and reports the lateral movement path.

decnet/correlation/
  parser.py   — RFC 5424 line → LogEvent; handles src_ip + src field variants
  graph.py    — AttackerTraversal / TraversalHop data types with path/duration
  engine.py   — CorrelationEngine: ingest(), traversals(), report_table/json,
                traversal_syslog_lines() (emits WARNING-severity RFC 5424)
  __init__.py — public API re-exports

decnet/cli.py — `decnet correlate` command (--log-file, --min-deckies,
                --output table|json|syslog, --emit-syslog)

tests/test_correlation.py — 49 tests: parser, graph, engine, reporting

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-04 13:53:30 -03:00

correlation

Add cross-decky correlation engine and decnet correlate command

2026-04-04 13:53:30 -03:00

logging

Fix TypeError on Python <3.10: add from __future__ import annotations

2026-04-04 04:46:53 -03:00

services

Add deaddeck: real interactive SSH entry-point machine

2026-04-04 13:42:19 -03:00

__init__.py

Initial commit: DECNET honeypot/deception network framework