2 Commits

Author	SHA1	Message	Date
kitos	9a020f97ef	fix(detection-lifecycle): fix timezone naive/aware mismatch and duplicate technique mapping ... - Replace datetime.now(timezone.utc) with datetime.utcnow() in _now() across all three Phase 8 files to match DB DateTime column type (naive UTC) - Guard POST /assets/{id}/techniques/{tid} against duplicate mappings: if mapping already exists, update coverage_type/confidence_level instead of inserting a duplicate row Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-19 16:29:04 +02:00
kitos	1fe150963c	feat(dlm): Phase 8 — Detection Lifecycle Management [FASE-8] ... Tasks 8.1-8.5: Models (8.1): - DetectionAsset: SIEM/EDR/Sigma rule assets with auto-hash - DetectionTechniqueMapping: N:M asset ↔ technique coverage - DetectionValidation: immutable validation records with expiry - TechniqueConfidenceScore: computed multi-factor confidence - InfrastructureChangeLog: infra changes that invalidate detections - DecayPolicy: configurable freshness thresholds per platform/tactic Services (8.2, 8.3): - detection_asset_service: CRUD + SHA-256 rule hashing + auto- invalidation on rule/infra changes - decay_engine_service: daily decay engine — expires stale validations, recalculates confidence (recency/coverage/health/diversity factors), processes infrastructure change propagation Router (8.4): 15 endpoints under /api/v1/detection-lifecycle: assets CRUD, technique mappings, validations, confidence scores, infrastructure changes, decay trigger, executive dashboard Scheduler (8.3): decay engine runs daily at 02:00 Seed (8.5): default policy (90/180/365d) + strict initial-access policy Migration: b034dlm (6 tables, 11 indexes) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-19 15:45:16 +02:00