Reference Index

Reference documentation for SenseGNAT. These documents describe the system precisely. They are consulted, not read cover-to-cover.

Documents

Document	Description
Data Model	All core frozen dataclasses: `NormalizedNetworkEvent`, `BehaviorProfile`, `Finding`, `Narrative`, and the canonical subject identity rule.
Detectors	All four anomaly detectors (`RareDestinationDetector`, `PeerDeviationDetector`, `PolicyViolationDetector`, `TimeWindowDriftDetector`): signatures, logic, finding properties, and evidence keys.
Adapters	The `EventAdapter` ABC and all four concrete implementations (`SampleEventAdapter`, `CsvEventAdapter`, `ZeekConnLogAdapter`, `SuricataEveAdapter`): constructor parameters, column/field mappings, and parse rules.
Policy Schema	The YAML policy file format: `groups` and `subjects` structure, field types, resolution rules (subject rules union with group rules), and a complete annotated example.
Configuration	`SenseGNATSettings` and its sub-models (`RuntimeSettings`, `StorageSettings`, `GNATSettings`), `load_settings(path)`, all fields with types and defaults, and a complete annotated YAML example.
GNAT Connector	`GNATConnector` constructor, all methods, the TAXII 2.1 transport details, `PushResult`, and complete STIX Indicator and Note field schemas with example JSON.

I want to know…	Go to
What fields does `NormalizedNetworkEvent` have?	Data Model — NormalizedNetworkEvent
How is `subject_id` derived?	Data Model — Subject Identity
What does `BehaviorProfile.merge()` do?	Data Model — BehaviorProfile
What evidence keys does each detector produce?	Detectors
What score/severity does each detector emit?	Detectors — Comparison Table
What CSV columns are required?	Adapters — CsvEventAdapter
How does Zeek column mapping work?	Adapters — ZeekConnLogAdapter
Which Suricata event types are processed?	Adapters — SuricataEveAdapter
How do group and subject policy rules combine?	Policy Schema — Resolution rules
What YAML keys does the policy file accept?	Policy Schema
What are the default config values?	Configuration
What STIX fields does a Finding produce?	GNAT Connector — STIX Indicator fields
What does `PushResult.ok` mean?	GNAT Connector — PushResult