Aegis

kitos/Aegis

Fork 0

Commit Graph

Author	SHA1	Message	Date
kitos	89a951c2a2	fix(decay-engine): strip tzinfo from validated_at before datetime arithmetic Some checks failed Aegis CI / lint-and-test (push) Has been cancelled Details The previous fix changed _now() to return naive UTC, but the code still called .replace(tzinfo=utc) on most_recent (from DB) before subtracting. This caused "can't subtract offset-naive and offset-aware datetimes". Now we strip tzinfo if present, keeping everything naive UTC consistently. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-19 16:35:02 +02:00
kitos	9a020f97ef	fix(detection-lifecycle): fix timezone naive/aware mismatch and duplicate technique mapping Some checks failed Aegis CI / lint-and-test (push) Has been cancelled Details - Replace datetime.now(timezone.utc) with datetime.utcnow() in _now() across all three Phase 8 files to match DB DateTime column type (naive UTC) - Guard POST /assets/{id}/techniques/{tid} against duplicate mappings: if mapping already exists, update coverage_type/confidence_level instead of inserting a duplicate row Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-19 16:29:04 +02:00
kitos	1fe150963c	feat(dlm): Phase 8 — Detection Lifecycle Management [FASE-8] Some checks failed Aegis CI / lint-and-test (push) Has been cancelled Details Tasks 8.1-8.5: Models (8.1): - DetectionAsset: SIEM/EDR/Sigma rule assets with auto-hash - DetectionTechniqueMapping: N:M asset ↔ technique coverage - DetectionValidation: immutable validation records with expiry - TechniqueConfidenceScore: computed multi-factor confidence - InfrastructureChangeLog: infra changes that invalidate detections - DecayPolicy: configurable freshness thresholds per platform/tactic Services (8.2, 8.3): - detection_asset_service: CRUD + SHA-256 rule hashing + auto- invalidation on rule/infra changes - decay_engine_service: daily decay engine — expires stale validations, recalculates confidence (recency/coverage/health/diversity factors), processes infrastructure change propagation Router (8.4): 15 endpoints under /api/v1/detection-lifecycle: assets CRUD, technique mappings, validations, confidence scores, infrastructure changes, decay trigger, executive dashboard Scheduler (8.3): decay engine runs daily at 02:00 Seed (8.5): default policy (90/180/365d) + strict initial-access policy Migration: b034dlm (6 tables, 11 indexes) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-19 15:45:16 +02:00

Author

SHA1

Message

Date

kitos

89a951c2a2

fix(decay-engine): strip tzinfo from validated_at before datetime arithmetic

Aegis CI / lint-and-test (push) Has been cancelled

Details

The previous fix changed _now() to return naive UTC, but the code still
called .replace(tzinfo=utc) on most_recent (from DB) before subtracting.
This caused "can't subtract offset-naive and offset-aware datetimes".
Now we strip tzinfo if present, keeping everything naive UTC consistently.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-19 16:35:02 +02:00

kitos

9a020f97ef

fix(detection-lifecycle): fix timezone naive/aware mismatch and duplicate technique mapping

Aegis CI / lint-and-test (push) Has been cancelled

Details

- Replace datetime.now(timezone.utc) with datetime.utcnow() in _now() across
  all three Phase 8 files to match DB DateTime column type (naive UTC)
- Guard POST /assets/{id}/techniques/{tid} against duplicate mappings:
  if mapping already exists, update coverage_type/confidence_level instead
  of inserting a duplicate row

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-19 16:29:04 +02:00

kitos

1fe150963c

feat(dlm): Phase 8 — Detection Lifecycle Management [FASE-8]

Aegis CI / lint-and-test (push) Has been cancelled

Details

Tasks 8.1-8.5:

Models (8.1):
- DetectionAsset: SIEM/EDR/Sigma rule assets with auto-hash
- DetectionTechniqueMapping: N:M asset ↔ technique coverage
- DetectionValidation: immutable validation records with expiry
- TechniqueConfidenceScore: computed multi-factor confidence
- InfrastructureChangeLog: infra changes that invalidate detections
- DecayPolicy: configurable freshness thresholds per platform/tactic

Services (8.2, 8.3):
- detection_asset_service: CRUD + SHA-256 rule hashing + auto-
  invalidation on rule/infra changes
- decay_engine_service: daily decay engine — expires stale validations,
  recalculates confidence (recency/coverage/health/diversity factors),
  processes infrastructure change propagation

Router (8.4): 15 endpoints under /api/v1/detection-lifecycle:
  assets CRUD, technique mappings, validations, confidence scores,
  infrastructure changes, decay trigger, executive dashboard

Scheduler (8.3): decay engine runs daily at 02:00
Seed (8.5): default policy (90/180/365d) + strict initial-access policy
Migration: b034dlm (6 tables, 11 indexes)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-19 15:45:16 +02:00

3 Commits