skidfire
46 lines
1.7 KiB
C#
46 lines
1.7 KiB
C#
using System;
|
|
using System.Collections.Generic;
|
|
|
|
namespace VanadiumGuard.Protocol
|
|
{
|
|
/// <summary>
|
|
/// One observation. The client fills these in and ships them; it draws no conclusions.
|
|
/// </summary>
|
|
public sealed class Detection
|
|
{
|
|
public DetectionCode Code { get; set; }
|
|
|
|
public Severity Severity { get; set; }
|
|
|
|
/// <summary>
|
|
/// 0-100. How sure the client is that the observation is what it looks like, rather
|
|
/// than a legitimate program that happens to match. The policy engine multiplies
|
|
/// weight by confidence, so a noisy heuristic can stay enabled at low confidence
|
|
/// without ever reaching a disconnect on its own.
|
|
/// </summary>
|
|
public int Confidence { get; set; }
|
|
|
|
/// <summary>Normalised subject: module base name, process image name, method signature.</summary>
|
|
public string Subject { get; set; } = string.Empty;
|
|
|
|
/// <summary>Which detector produced this, for triage.</summary>
|
|
public string Detector { get; set; } = string.Empty;
|
|
|
|
/// <summary>Supporting detail. Keep it small; it is stored verbatim.</summary>
|
|
public Dictionary<string, string> Evidence { get; set; } = new Dictionary<string, string>();
|
|
|
|
public DateTimeOffset FirstObservedUtc { get; set; }
|
|
|
|
public DateTimeOffset LastObservedUtc { get; set; }
|
|
|
|
/// <summary>Times this exact Code plus Subject pair was seen before the batch flushed.</summary>
|
|
public int OccurrenceCount { get; set; } = 1;
|
|
|
|
/// <summary>Dedupe key used by both the client sink and the server store.</summary>
|
|
public string DedupeKey()
|
|
{
|
|
return ((int)Code).ToString() + "|" + Subject;
|
|
}
|
|
}
|
|
}
|