# SPDX-License-Identifier: GPL-3.0-or-later
"""Event-driven detection layer.

Where the poll-based detectors sweep system state every few seconds, this layer
reacts to kernel events the instant they happen — so a process that executes,
decrypts memory, changes page protections, or exits between two sweeps is still
caught. Events come from eBPF (``bcc``) and are matched against declarative,
Snort-style rule sets.
"""