feat(rulemanager): CEL rule state store for cross-event correlation - #875

Open

slashben wants to merge 17 commits into

mainfrom

feat/cel-rule-state-store

Commits on Aug 3, 2026

refactor(rulemanager): embed armotypes.RuntimeRule in typesv1.Rule
slashben
committed
7605e22
feat(cel): expose the resolved event timestamp as a CEL variable
slashben
committed
01b5191
feat(processtree): add GetAncestorPIDs for ancestry-based rule matching
slashben
committed
77b8148
feat(rulestate): add the TTL-bounded rule state store
slashben
committed
c4227f1
feat(cel): add state.has/get/has_ancestor/get_ancestor read functions
slashben
committed
2cf9d56
feat(rulemanager): validate and execute stateWrites clauses
slashben
committed
54a5b29
feat(rulemanager): attach correlation evidence to alerts
slashben
committed
83cbc7c
feat(rulestate): wire config defaults, metrics and container-removal purge
slashben
committed
48145fd
fix(rulemanager): keep ReportRuleProcessed semantics across the loop refactor
slashben
committed
bf88da7
test(component): add CEL state store test rules and workload
slashben
committed
f290597
test(component): prove the CEL state store end-to-end against real eBPF
slashben
committed
c54bb3a
ci: run the state-store and exec-TTY component tests
slashben
committed
a0aaa7c
fix(crd): add stateWrites to the Rules schema, without which it is pruned
slashben
committed
577791d
docs: record the cluster verification and the helm-charts CRD prerequisite
slashben
committed
686fbdb
test(processtree): satisfy the creator interface after the boot-time rebase
slashben
committed
0a30757
docs: add a troubleshooting order for silent correlation failures
slashben
committed
67a2c61
fix(rulestate): address review — node-scope cap, global-cap replacements, nil guard
slashben
committed
811a482

Navigation Menu

Uh oh!

feat(rulemanager): CEL rule state store for cross-event correlation - #875

feat(rulemanager): CEL rule state store for cross-event correlation#875
slashben wants to merge 17 commits into
mainfrom
feat/cel-rule-state-store

Commits on Aug 3, 2026

refactor(rulemanager): embed armotypes.RuntimeRule in typesv1.Rule

feat(cel): expose the resolved event timestamp as a CEL variable

feat(processtree): add GetAncestorPIDs for ancestry-based rule matching

feat(rulestate): add the TTL-bounded rule state store

feat(cel): add state.has/get/has_ancestor/get_ancestor read functions

feat(rulemanager): validate and execute stateWrites clauses

feat(rulemanager): attach correlation evidence to alerts

feat(rulestate): wire config defaults, metrics and container-removal purge

fix(rulemanager): keep ReportRuleProcessed semantics across the loop refactor

test(component): add CEL state store test rules and workload

test(component): prove the CEL state store end-to-end against real eBPF

ci: run the state-store and exec-TTY component tests

fix(crd): add stateWrites to the Rules schema, without which it is pruned

docs: record the cluster verification and the helm-charts CRD prerequisite

test(processtree): satisfy the creator interface after the boot-time rebase

docs: add a troubleshooting order for silent correlation failures

fix(rulestate): address review — node-scope cap, global-cap replacements, nil guard