9 lines
422 B
Python
9 lines
422 B
Python
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
"""Event-driven detection layer.
|
|
|
|
Where the poll-based detectors sweep system state every few seconds, this layer
|
|
reacts to kernel events the instant they happen — so a process that executes,
|
|
decrypts memory, changes page protections, or exits between two sweeps is still
|
|
caught. Events come from eBPF (``bcc``) and are matched against declarative,
|
|
Snort-style rule sets.
|
|
"""
|