netverdict 0.5.0__tar.gz

netverdict-0.5.0/LICENSE

@@ -0,0 +1,338 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+                            NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Moe Ghoul>, 1 April 1989
+  Moe Ghoul, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.

netverdict-0.5.0/PKG-INFO

@@ -0,0 +1,300 @@
+Metadata-Version: 2.4
+Name: netverdict
+Version: 0.5.0
+Summary: Triage d'incident reseau/app/OS : analyse une capture et rend un verdict argumente avec preuves
+Author: rhnetwork
+License: GPL-2.0-only
+Project-URL: Homepage, https://github.com/serytia/netverdict
+Project-URL: Repository, https://github.com/serytia/netverdict
+Project-URL: Issues, https://github.com/serytia/netverdict/issues
+Keywords: pcap,tcp,network,troubleshooting,sysadmin,packet-analysis,incident-response,sysmon,auditd
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: System Administrators
+Classifier: Intended Audience :: Information Technology
+Classifier: License :: OSI Approved :: GNU General Public License v2 (GPLv2)
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: System :: Networking :: Monitoring
+Classifier: Topic :: System :: Systems Administration
+Classifier: Topic :: Security
+Classifier: Natural Language :: French
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: dpkt>=1.9.8
+Requires-Dist: rich>=13.0
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: tzdata; sys_platform == "win32"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == "dev"
+Provides-Extra: explain
+Requires-Dist: anthropic>=0.60; extra == "explain"
+Provides-Extra: evtx
+Requires-Dist: python-evtx>=0.8; extra == "evtx"
+Dynamic: license-file
+
+# netverdict
+
+**La capture reseau dit si le probleme vient du reseau, de l'application ou du
+systeme — avec les preuves, et une piste de correction.**
+
+Fini le blame game "c'est le reseau / c'est l'appli / c'est le serveur".
+`netverdict` lit un pcap (et si possible un snapshot de l'etat de l'hote pris
+au meme moment), en extrait les signaux TCP qui ne mentent pas, et rend un
+**verdict argumente** :
+
+```
+$ netverdict analyze capture.pcapng --snapshot snapshot.json
+
+18 paquets lus - 18 TCP, 0 ICMP, 0 non-IP, 0 illisibles - 1 conversations
++---------  APP - 10.0.0.42:51006 -> 10.0.0.5:5432 [confiance haute] --------+
+| Reponse applicative lente, reception prouvee par ACK rapide                |
+|   * 3 echanges : ACK serveur en 5 ms mais reponse en 800 ms (p50), 0 perte |
+|   * etat hote : [SRV-DB01] socket detenue par postgres (pid 4212),         |
+|     cpu machine 22%, disque 97%, ram libre 512 Mo                          |
+|                                                                            |
+| Piste de correction :                                                      |
+|   Le reseau a livre la requete (ACK immediat) puis a attendu l'application.|
+|   Chercher COTE APPLICATIF de 10.0.0.5:5432 : ...                          |
++----------------------------------------------------------------------------+
+```
+
+Le raisonnement est celui qu'un expert applique en lisant un pcap dans
+Wireshark — encode dans un moteur de regles deterministe :
+
+| Signature observee | Verdict |
+|---|---|
+| SYN repetes sans reponse | RESEAU (DROP silencieux ou hote injoignable) |
+| ICMP admin-prohibited | RESEAU (REJECT explicite, l'equipement est identifie) |
+| RST immediat au SYN | APP (rien n'ecoute sur ce port) |
+| Retransmissions massives | RESEAU (perte sur le chemin) |
+| Zero window | HOTE (l'application ne lit plus sa socket) |
+| ACK rapide mais reponse lente | APP (le delai est dans le serveur, preuve a l'appui) |
+| ICMP fragmentation-needed | RESEAU (MTU/tunnel) |
+| RST en pleine session | AMBIGU (timeout firewall, IPS, ou crash — qui a emis ?) |
+
+## Installation
+
+Pas encore publie sur PyPI — installation depuis les sources :
+
+```
+git clone https://github.com/serytia/netverdict
+cd netverdict
+pip install .                     # analyse : aucune dependance systeme
+pip install ".[explain]"          # + synthese narrative via l'API Claude (optionnel)
+pip install ".[evtx]"             # + lecture directe des .evtx binaires
+```
+
+100 % Python (dpkt). Pas besoin de Wireshark/tshark, ni sur le poste
+d'analyse, ni sur les serveurs.
+
+## Usage
+
+```
+# Analyser une capture existante
+netverdict analyze capture.pcapng
+netverdict analyze capture.pcapng --json          # sortie machine
+netverdict analyze capture.pcapng --explain       # + synthese narrative (API Claude)
+
+# v1.1 : croiser avec ce qui a change dans l'infra (timeline)
+netverdict analyze capture.pcapng --events events.xml --syslog fw01.log
+#   --events : events Windows (.evtx avec l'extra [evtx], ou export XML :
+#              wevtutil qe System /f:xml > events.xml)
+#   --syslog : fichiers syslog plats (RFC3164/RFC5424 melanges acceptes)
+
+# Fuseau des lignes RFC3164 (le format n'en porte AUCUN). A donner des que le
+# syslog ne vient pas d'une machine reglee comme le poste d'analyse : sinon les
+# evenements se decalent et sortent de la fenetre, en silence.
+netverdict analyze capture.pcapng --syslog central.log --syslog-tz UTC
+netverdict analyze capture.pcapng --syslog fw01.log    --syslog-tz Europe/Paris
+netverdict analyze capture.pcapng --syslog fw01.log    --syslog-tz +02:00
+#   UTC / nom IANA / decalage fixe. Le nom IANA gere l'heure d'ete.
+#   Sans effet sur les lignes RFC5424, qui portent deja leur fuseau.
+
+# OU les paquets se perdent-ils ? Deux captures du meme trafic, deux points.
+netverdict compare amont.pcap aval.pcap
+#   amont = pres du client, aval = pres du serveur, captures SIMULTANEES.
+#   Un segment vu en amont et absent en aval s'est perdu ENTRE les deux
+#   points ; s'ils sont tous retrouves, le chemin intermediaire est hors de
+#   cause et il faut chercher au-dela. C'est le seul moyen de trancher sans
+#   supposition. Les horloges des deux machines n'ont pas besoin d'etre
+#   synchronisees : le decalage est estime, et l'outil se tait sur la latence
+#   plutot que d'en inventer une quand il ne peut pas l'estimer.
+
+# Qui detenait la socket ? La reponse MEME SI le process est deja mort.
+netverdict analyze capture.pcap --audit /var/log/audit/audit.log   # Linux
+netverdict analyze capture.pcapng --events sysmon.xml              # Windows (Sysmon)
+netverdict analyze capture.pcapng --events security.xml            # Windows (WFP natif)
+#   WFP = audit natif Windows, SANS installer d'agent :
+#     auditpol /set /subcategory:"Filtering Platform Connection" /success:enable
+#     wevtutil qe Security /f:xml > security.xml
+#     auditpol /set /subcategory:"Filtering Platform Connection" /success:disable
+#   (tres verbeux : a activer le temps du diagnostic. 5157 dit aussi quel
+#    process s'est fait BLOQUER une connexion — Sysmon, lui, reste muet.)
+#   Le snapshot d'etat hote est pris a UN instant : il rate le process qui
+#   s'est termine avant la fin de la capture. Un journal, lui, date chaque
+#   connexion a son etablissement — l'attribution devient retroactive.
+#   Linux  : regle a charger (une fois) —
+#            auditctl -a always,exit -F arch=b64 -S connect -k netverdict_connect
+#            (persistant : un fichier dans /etc/audit/rules.d/)
+#   Windows: Sysmon avec NetworkConnect actif —
+#            sysmon -c netverdict/capture/sysmon-netverdict.xml
+#   Si la source est presente mais la regle absente, l'outil le DIT au lieu
+#   de rendre un rapport muet.
+# Le rapport ajoute les changements des 15 min precedant la capture
+# (service installe, regle firewall rechargee, passage sur batterie...)
+# et marque ceux qui precedent l'incident de peu.
+#
+# v1.2 : les changements pertinents sont AUSSI rattaches au flux concerne,
+# directement dans son panneau de verdict, sous « A verifier en premier ».
+# Un `*` signale un type de changement pouvant produire ce verdict precis
+# (regle firewall -> RESEAU, crash de service -> APP, batterie -> OS).
+# C'est un CLASSEMENT de suspects, jamais une conclusion de causalite : les
+# changements sans affinite restent affiches, plus bas.
+
+# Capture assistee : trafic + etat hote en un coup (console admin/root)
+netverdict capture --duration 60                  # Windows: pktmon (natif) / Linux: tcpdump
+
+# Lister les regles de verdict
+netverdict rules
+```
+
+Code retour : `0` = rien d'anormal, `1` = au moins un verdict, `2` = erreur.
+
+La capture assistee est **tronquee par defaut** (128 octets/paquet sous Windows,
+96 sous Linux) : suffisant pour l'analyse et leger.
+
+**Ce n'est PAS une garantie d'absence de credential**, contrairement a ce que
+ce README affirmait avant le 25/07/2026. La troncature coupe a N octets *depuis
+le debut de la trame* — un paquet plus court que N est donc capture EN ENTIER,
+payload compris. Mesure :
+
+| Payload | `-s 96` | 128 o |
+|---|---|---|
+| `PASS hunter2` (POP3/FTP en clair) | **complet** | **complet** |
+| `USER admin` + `PASS ...` | **complet** | **complet** |
+| `{"token":"eyJhbGciOi..."}` | **complet** | **complet** |
+| En-tete `Authorization: Basic ...` (51 o) | 42/51 o | **complet** |
+
+Autrement dit : la troncature elimine les gros transferts, pas les secrets
+courts — et les protocoles d'authentification en clair sont precisement courts.
+Traiter un bundle comme une donnee sensible : le relire avant de le transmettre,
+et preferer `--full-packets` uniquement quand c'est necessaire et assume.
+
+L'option `--explain` n'envoie jamais le pcap : uniquement le rapport JSON
+(signaux et verdicts).
+
+## Comment ca marche
+
+Deux etages strictement separes, comme decodeurs/regles dans Wazuh :
+
+1. **Mesure** (`pcap.py`, `flows.py`, `signals.py`) : lecture de la capture,
+   reconstruction des conversations TCP, calcul des signaux — retransmissions
+   (avec exclusion des doublons de capture et des keepalives), RTT, zero
+   window, delai requete->reponse applicatif, delai d'ACK serveur, ICMP
+   rattaches. Que des faits, aucun jugement.
+2. **Verdict** (`rules/`) : regles declaratives YAML — conditions sur les
+   signaux, verdict, confiance, preuves interpolees, remediation redigee.
+   Chaque seuil est commente avec sa justification.
+
+Ajouter ses propres regles : `netverdict analyze ... --rules mes_regles.yaml`
+(meme format que `netverdict/rules/builtin.yaml`).
+
+## Plateformes
+
+| | Analyse (`analyze`) | Capture assistee | Jointure process <-> flux |
+|---|---|---|---|
+| Linux | oui | `capture.sh` (tcpdump + ss) | `--audit` (auditd) |
+| Windows | oui | `capture.ps1` (pktmon, natif) | `--events` : Sysmon EID 3, **ou WFP 5156/5157 sans agent** |
+| macOS | oui | non — capturer avec `tcpdump`, puis analyser | non |
+
+`compare` (deux captures, deux points) fonctionne sur les trois.
+
+CI : Linux/Windows/macOS x Python 3.11-3.13, plus un job en fuseau decale,
+un avec les extras installes, un sur le paquet construit.
+
+## Statut de validation
+
+- **Valide** : 239 tests automatises, verts sur Linux, Windows et macOS
+  (Python 3.11 a 3.13) et sous fuseau decale.
+- **Valide au kernel** : 8 scenarios de panne reproduits par un vrai noyau
+  Linux (netem, iptables, vraies sockets — `lab/`), plus la jointure auditd
+  sur un journal auditd reel. Les pcaps produits servent de fixtures.
+- **Valide sur incident reel** : chaine de capture Windows complete (pktmon
+  -> analyse) contre un service lent, un port ferme et un port filtre — les
+  trois verdicts exacts.
+- **Pas encore fait** : incidents de production subis (non provoques). Les
+  verdicts sont un point de depart outille, pas un oracle — AMBIGU est un
+  verdict assume, et le rapport dit ce qu'il n'a pas su lire.
+
+Ce que ces validations ont coute, et pourquoi elles figurent ici : chacune a
+trouve des defauts que les tests sur donnees fabriquees ne voyaient pas —
+detection de retransmissions cassee par TSO/GSO, `pktmon` qui annonce un
+type de trame et en ecrit un autre, `auditd` dont le format par defaut n'est
+pas celui de sa documentation, et des pannes Windows declenchees par des
+donnees Linux. Les fixtures ecrites a la main decrivent l'outil qu'on
+imagine ; l'execution reelle decrit celui qui existe.
+
+## Limites connues (v1)
+
+- TCP/IPv4-IPv6 uniquement (pas d'UDP/QUIC, pas de reassemblage de fragments).
+- RTT p95 pollue par les delayed ACK (~40-200 ms) : min et p50 sont fiables.
+  Aucune regle ne rend donc un verdict RESEAU sur le seul p95. En revanche un
+  p95 eleve n'est pas ignore : une mediane saine avec une queue significative
+  produit un verdict AMBIGU explicite (« pics de latence que la capture ne sait
+  pas attribuer »), qui nomme les deux causes possibles — gigue du chemin ou
+  delayed ACK — et donne de quoi les separer. Ni faux verdict reseau, ni faux
+  « transport sain ».
+- Sens client/serveur estime par heuristique si la capture demarre en pleine
+  session (signale dans le rapport).
+- Le snapshot hote vient d'une seule machine (celle ou on a lance la capture).
+  Il est pris a UN instant : il rate le process deja mort a la fin de la
+  capture. La jointure Sysmon (Event ID 3), elle, est retroactive et le
+  retrouve — voir « Jointure process » ci-dessous.
+- Jointure process <-> flux : correspondance sur le quadruplet EXACT (les deux
+  sens sont testes), TCP uniquement, avec 60 s de tolerance d'horloge entre la
+  capture et le journal. Un port client reutilise pendant la capture produit
+  plusieurs candidats : le plus proche du debut du flux est retenu, et le
+  rapport signale l'ambiguite plutot que de la taire.
+- Syslog RFC3164 (sans fuseau) : par defaut l'heure est interpretee dans le
+  fuseau du poste d'analyse, et les horodatages concernes sont marques `~`
+  dans le rapport. Une source en UTC lue depuis un poste en heure locale se
+  decale alors HORS de la fenetre, et le rapport affiche « aucun changement
+  detecte » — a lire comme « rien n'a ete retenu », pas comme « rien n'a
+  change ». **Corriger avec `--syslog-tz`** (voir Usage) : les horodatages
+  deviennent exacts, le `~` disparait et le delai avant l'incident est donne
+  a la seconde.
+- `--syslog-tz` avec un decalage FIXE (`+02:00`) est faux de part et d'autre
+  d'un changement d'heure : un fichier qui traverse le passage a l'heure
+  d'hiver sera mal date sur une moitie. Preferer un nom IANA
+  (`Europe/Paris`), qui gere l'heure d'ete. Sur une heure ambigue (celle qui
+  existe deux fois lors du retour a l'heure d'hiver), la premiere occurrence
+  est retenue.
+
+## Roadmap
+
+- v1.1 (fait) : timeline multi-sources — events Windows (EVTX/XML) + syslog
+  pour repondre a "qu'est-ce qui a change dans l'infra juste avant ?".
+- v1.2 (fait) : `--syslog-tz`, correlation changement->verdict, jointure
+  process<->flux retroactive via Sysmon Event ID 3. **Reste a valider sur un
+  vrai enregistrement Sysmon** : les noms de champs viennent du schema du
+  binaire, la forme du XML est celle des evenements Windows standards deja
+  parses par sources/evtx.py. Pour activer la source (console admin) :
+
+  ```powershell
+  sysmon -i -accepteula <chemin>\netverdict\capture\sysmon-netverdict.xml
+  ```
+
+  Cette configuration n'active QUE l'Event ID 3 (NetworkConnect), desactive par
+  defaut dans le Sysmon livre avec Windows 11 24H2. Les 21 autres types
+  d'evenements y sont en `onmatch="include"` sans aucune regle, ce qui les
+  laisse eteints — on n'allume pas un journal complet pour une jointure.
+- v2 : capture pilotee des deux cotes (client ET serveur) et comparaison.
+
+## Licence
+
+GPL-2.0