anti
eff3e4bce7
Reads pre-shaped session aggregates from TaggerEvent.payload and emits techniques per Appendix A behavior tables. Per-rule predicates dispatch on match.kind (lifter:behavioral_<name>); the lifter holds its own RuleIndex watching the same RuleStore as the engine, so disable / clip / TTL state reaches lifter-bound rules through the same atomic-swap path. R0032/R0036/R0037/R0040 YAMLs had over-escaped regex strings (\\ instead of \\) — fixed in place. Factory wired so default get_tagger() returns CompositeTagger with BehavioralLifter shipped; remaining three lifters (E.3.10-E.3.12) land in subsequent commits. E.2.6 contract preserved via TolerantTagger: empty payload steady-state yields [] with zero ERROR records. Disabled / clipped / expired state verified.
49 lines
1.5 KiB
Python
49 lines
1.5 KiB
Python
"""Shared stub :class:`RuleStore` for lifter unit tests.
|
|
|
|
Tests that exercise :class:`BehavioralLifter` / :class:`IntelLifter` /
|
|
:class:`CanaryFingerprintLifter` / :class:`EmailLifter` need a store
|
|
reference at construction. Most don't drive the watch loop — they
|
|
inject rules into the lifter's :class:`RuleIndex` directly. This stub
|
|
provides just enough of the ABC to satisfy construction.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
from collections.abc import AsyncIterator
|
|
from typing import Any
|
|
|
|
from decnet.ttp.impl.rule_engine import CompiledRule
|
|
from decnet.ttp.store.base import RuleChange, RuleState, RuleStore
|
|
|
|
|
|
class StubRuleStore(RuleStore):
|
|
"""In-memory store with optional preloaded compiled rules."""
|
|
|
|
def __init__(
|
|
self,
|
|
compiled: list[CompiledRule] | None = None,
|
|
changes: list[RuleChange] | None = None,
|
|
) -> None:
|
|
self._compiled = list(compiled or [])
|
|
self._changes = list(changes or [])
|
|
|
|
async def load_compiled(self) -> list[CompiledRule]:
|
|
return list(self._compiled)
|
|
|
|
async def get_state(self, _rule_id: str) -> RuleState:
|
|
return RuleState()
|
|
|
|
async def set_state(self, *_a: Any, **_kw: Any) -> None:
|
|
return None
|
|
|
|
def subscribe_changes(self) -> AsyncIterator[RuleChange]:
|
|
changes = list(self._changes)
|
|
|
|
async def _gen() -> AsyncIterator[RuleChange]:
|
|
for change in changes:
|
|
yield change
|
|
|
|
return _gen()
|
|
|
|
|
|
__all__ = ["StubRuleStore"]
|