Repository navigation
Add behavioural anomalies and EPSS/KEV enrichment (long tail, part 1) - #43
Merged
Merged
Conversation
Completion item 5 from the re-review (~/Documents/Testing/plans/2026-10-27-predictive-completion.md), first of two parts: the UEBA breadth that does not require an external dataset, and the EPSS/KEV half of exploitability enrichment. Behavioural anomalies: - Two new bounded CloudTrail analyzer queries share the established shape (7-day evaluation against a 30-day baseline, partition projection, the same exclusions): NEW_API_FOR_PRINCIPAL (calls a principal never made in the baseline — a never-touched service shows through its calls) and UNUSUAL_HOUR_ACTIVITY (UTC hours never used). Both rows carry a detail column (new APIs / hours, capped at 200 chars) that the anomaly nodes record. - RULE-035 (medium; first-use APIs are a lead) and RULE-036 (low; timezone moves trip it) surface them; neither auto-tickets. ASN attribution is deferred with its reason recorded: it needs an external IP-to-ASN dataset and a licensing decision. EPSS/KEV: - threat-intel types gain cve (known-exploited membership, e.g. a CISA KEV export) and epss (CVE,score lines — the FIRST CSV's first two columns), with validation, dedup, caps and TTL unchanged; the store carries the score; Vulnerabilities' cve_id candidates both lookups. - A KEV match marks the exploit available and EPSS rides exploitability through one shared helper — max(CVSS/10, EPSS) + 0.2 for a known exploit, clamped — now used by both pathLikelihood and computeRiskScore so the likelihood and the score can no longer disagree. - Terraform variables/outputs, chart values/schema/configmap and the OPERATIONAL runbook wire the two new list URIs. Load-bearing updates, explicit: the rule catalogue goes 34 -> 36 (pinned counts in rules.test.ts, README, ARCHITECTURE updated); REVIEWED_MAPPING gains reviewed entries for both rules (-> KH-DET-1); RULE_TECHNIQUES gains T1078 for each; getRemediationHint gains both hints; KH-DET-1 is broadened from credential-use to identity anomalies with the new rules and evidence text (control counts unchanged). Why this is safe: both queries are read-only, window-bounded and exclusion-filtered like the existing three; the new rules report behavioural leads with auto-ticketing off; the threat-intel additions reuse the reviewed import path (validation, cap, TTL) and only raise exploitability through values the score already carried (CVSS, exploit-known); no new write surface and no identifiers.
rules.graph.test.ts's "every rule has a graph test" guard scans the file for rule ids; the two new anomaly rules need their real Gremlin coverage. Extend the anomaly-type matrix with both types and both rules. Why this is safe: test-only change; runs in the graph-queries job.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Completion item 5, part 1 of 2 (
~/Documents/Testing/plans/2026-10-27-predictive-completion.md): the UEBA breadth that needs no external dataset, plus the EPSS/KEV half of exploitability enrichment. 27 files, +671/−86.Behavioural anomalies (CloudTrail analyzer)
NEW_API_FOR_PRINCIPAL: calls a principal never made in the 30-day baseline (a never-touched service shows through its calls) — medium, RULE-035UNUSUAL_HOUR_ACTIVITY: UTC hours never used in the baseline — low, RULE-036detailcolumn recorded on the anomaly node, and auto-ticket off (behavioural leads wait for/rules/qualityevidence)EPSS/KEV enrichment
cve(known-exploited membership, e.g. CISA KEV export) andepss(CVE-YYYY-NNNN,score— FIRST CSV's first two columns); store carries the score;Vulnerability.cve_idcandidates both lookupsmax(CVSS/10, EPSS)+ 0.2 for a known exploit — they can no longer disagreeLoad-bearing updates (explicit, per AGENTS.md)
rules.test.ts, README, ARCHITECTURE updated)REVIEWED_MAPPINGgains reviewed entries for RULE-035/036 (→ KH-DET-1, with reasons);RULE_TECHNIQUESgains T1078 each;getRemediationHintgains both hintsWhy this is safe
Test plan
npx jest --runInBand— 20 projects / 1863 tests passed (new: query shape/bounds, detail parsing + cap, 5-vs-6 column rules, EPSS/KEV parsing + candidates, runner KEV/EPSS threading, shared exploitability helper, rule/technique/remediation/mapping pins)npm run typecheck; full workspace lint;npm run format:checknpm run ci:build;npm run package:lambdas;terraform fmt -check; chart schema parses (helm validation in CI)