Expand description
Hunt Correlate — correlation rules, watch mode, and IOC matching for clawdstrike hunt.
Modules§
- engine
- Correlation engine — evaluates correlation rules against event streams using sliding windows.
- error
- ioc
- IOC (Indicator of Compromise) matching engine.
- report
- Evidence report generation with Merkle-anchored integrity proofs.
- rules
- Correlation rule YAML schema, parsing, and validation.
- watch
- Real-time NATS watch mode — subscribes to spine envelope subjects,
evaluates correlation rules via
CorrelationEngine, and emits alerts.