[A·M2] Session capture to audit log + metrics #16

New issue

Closed

opened 2026-06-24 23:49:59 +00:00 by vxfemboy · 1 comment

vxfemboy commented

2026-06-24 23:49:59 +00:00

(Migrated from github.com)

Record every deception session (commands, attempted credentials, payloads) to the audit log and expose Prometheus counters. Part of #2.

vxfemboy commented

2026-07-09 04:33:43 +00:00

(Migrated from github.com)

Implemented. Every completed deception session is persisted and counted:

Audit capture: serve emits a SessionRecord (destination, peer, proto, emulator, bytes in/out, and outcome.note — the captured request line / attempted credentials) per session; the blackwalld drain loop writes each as a SessionRow via store.record_session (bin/blackwalld/src/main.rs:1787).
Prometheus counters: blackwall_deception_sessions_active (live in-flight gauge) and blackwall_audit_total (persisted-session count) are exposed on /metrics (bin/blackwalld/src/metrics.rs).

Exercised by the deception lab gates (all green). Closing.

Implemented. Every completed deception session is persisted and counted: - **Audit capture**: `serve` emits a `SessionRecord` (destination, peer, proto, emulator, bytes in/out, and `outcome.note` — the captured request line / attempted credentials) per session; the blackwalld drain loop writes each as a `SessionRow` via `store.record_session` (bin/blackwalld/src/main.rs:1787). - **Prometheus counters**: `blackwall_deception_sessions_active` (live in-flight gauge) and `blackwall_audit_total` (persisted-session count) are exposed on `/metrics` (bin/blackwalld/src/metrics.rs). Exercised by the deception lab gates (all green). Closing.