# SPDX-License-Identifier: GPL-3.0-or-later
"""Event-driven detection layer.

Where the poll-based detectors sweep system state every few seconds, this layer
reacts to kernel events the instant they happen — so a process that executes and
exits between two sweeps (fileless droppers, short-lived reverse shells) is still
caught. Events come from eBPF (``bcc``) and are matched against a declarative,
Snort-style rule set.
"""