Module behavior 

The behavior-rule engine, ported from the reference behavior handler and its mixins. The go port is the structural template.

Reference sources: guard_core/handlers/behavior_handler.py (BehaviorTracker, BehaviorRule, config_to_rule), the response-pattern mixin (_behavior_response_pattern.py + _behavior_json_pattern.py), and the action dispatch (_behavior_action_dispatch.py).

The engine owns the tracking and the verdict; the caller supplies the response facts (status code and the already-captured body prefix) and receives the action to dispatch. The body prefix is the caller’s capture, bounded by the reference behavior_max_response_body_inspect_bytes budget: status: patterns never touch it, and the other pattern kinds see only the leading prefix.

Example

use guard_core_engine::behavior::{BehaviorAction, BehaviorRule, BehaviorTracker};
use std::time::SystemTime;

let mut tracker = BehaviorTracker::new();
let rule = BehaviorRule {
    rule_type: "return_pattern".to_owned(),
    threshold: 2,
    window: 3600,
    pattern: "status:404".to_owned(),
    action: "ban".to_owned(),
    ban_duration: Some(900),
    correlate_with_detection: false,
};
let now = SystemTime::now();
// Two 404s stay below a threshold of 2 (`len(timestamps) > threshold`).
assert!(!tracker.track_return_pattern("GET:/api", "192.0.2.10", 404, None, &rule, 262_144, now));
assert!(!tracker.track_return_pattern("GET:/api", "192.0.2.10", 404, None, &rule, 262_144, now));
// The third crossing trips the rule ...
assert!(tracker.track_return_pattern("GET:/api", "192.0.2.10", 404, None, &rule, 262_144, now));
// ... and the dispatch decides what happens: a ban for 900s.
assert_eq!(
    BehaviorTracker::dispatch_action(&rule, "192.0.2.10", false),
    BehaviorAction::Ban { duration: 900 }
);

Structs

BehaviorRule

The reference BehaviorRule, field for field.

BehaviorTracker

The reference BehaviorTracker’s in-memory return-pattern windows.

Enums

BehaviorAction

What apply_action decided for one tripped rule: the observable part of the reference BehaviorActionDispatchMixin.

Constants

DEFAULT_MAX_RESPONSE_BODY_INSPECT_BYTES

The default response-body prefix the reference reads for a non-status: pattern (behavior_max_response_body_inspect_bytes default, 262144).

Functions

rule_from_config

The reference config_to_rule: the corpus config dict shape.

unix_now

time.time() as the tracker’s float Unix timestamp.