feat(go): add Phase 1 parity sidecar
This commit is contained in:
parent
65f5be6420
commit
f02509aab5
22 changed files with 947 additions and 6 deletions
|
|
@ -226,7 +226,10 @@ signature keeps `sid` / `signature` / `classtype` / tests / docs.
|
|||
as event types). This is the Python↔Go contract. *No language change yet.*
|
||||
- **Phase 1 — Go agent skeleton.** Config, daemon sweep loop, `SystemState`
|
||||
equivalent, poll detectors ported, JSON output matching schemas. Runs
|
||||
alongside Python; harness compares both.
|
||||
alongside Python; harness compares both. *In progress:* the isolated
|
||||
`go-agent/` sidecar now has stdlib config loading, an injectable `/proc`
|
||||
process view, the JSONL sweep loop, and fixture parity for `deleted_exe`;
|
||||
Python remains the production agent.
|
||||
- **Phase 2 — eBPF via `cilium/ebpf`.** Port exec/syscall rules; drop the
|
||||
bcc/Python runtime dependency; single static binary.
|
||||
- **Phase 3 — Rule-engine parity + assimilation.** `rev`/`reference`/`metadata`,
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue