attesta
What your rules
really catch
The rules a security agent evaluates on a running system (a process
started, a file opened, a connection made), given an
exact meaning.
What a rule catches, misses, or
changed between two versions is proven, shown with
a witness, or marked as a solver's word alone. Never estimated, and
deterministic.
Reads one engine's rules today: check, intent, audit, compare, explain, and re-check any report.
- Your rules detection rules, their intent, filter configurations, two versions of a set
- Their exact meaning the engine's, not the manual's, stated in Lean and checked
- Answers you can check each claim with its evidence: proven, witnessed, or a solver's word, said so
attesta gives a rule language its formal semantics. A rule is a question asked of every event; once it has an exact meaning, what it catches, what it misses and whether two rules are one can be checked by a machine.
Meaning first, then answers
01 Meaning
A rule means what the engine does
Where possible, the meaning comes from the engine's source, not its documentation: how operators group, what a missing field does, what each comparison really compares. The model is then tested against the engine at its edges, and each report says whether its witnesses were replayed on the engine.
02 Evidence
Proven, witnessed, or said so
"No event does this" is a theorem proven in Lean, carrying its reason, so anyone can check it again without a search. "This rule fires here and that one does not" is an event, replayed through the engine. When only a solver agrees, the finding says so.
03 Honesty
What cannot be encoded is refused
A rule that uses something the model has no exact meaning for is set aside with the reason, never approximated. A witness that does not replay is reported as undecided, never as a finding.
04 AI
Whoever writes the rule, the checker decides
A rule drafted by a person or by a model gets the same questions from the same checker: does it fire, does it duplicate a rule, does it meet its intent. The model proposes, the checker decides, and attesta re-checks any report from its data, whoever produced it. Same rule files, same attesta, same solver: the same report, byte for byte, on any machine.
One command,
your rule files as input
A report in plain words, the same facts as data beside it. Every claim carries its evidence, and attesta re-checks any report: witnesses replayed, proofs checked again from their reasons.
Check a rule
The gate for CI: rules the engine would refuse, grouping that reads differently than it looks, rules no event can fire. A new rule, by a person or a model, held against the whole set and against what it was meant to catch: exact, narrower or wider, each gap with an event.
Audit a rule set
Dead rules, overlaps and equivalents across the whole set, with a witness event for every rule that can fire. Two versions compared by meaning, not by text: an event for every detection gained or lost. And what a filter configuration hides from the rules.
Explain and rewrite
Each rule's condition in words, beside the description its author wrote. The files rewritten into one normal form, with a theorem that the meaning did not move; rules from a shared, engine-neutral format brought in, each marked exact, narrower or wider by theorem, or refused with the reason.
What it finds
- rules that can never fire
- rules narrower or wider than their intent
- exceptions that never apply, or swallow their rule
- rules that never fire without another
- two rules with one meaning
- what a release changed in detection
How each finding knows
- proven a Lean theorem about the model, for every event.
- witnessed an event, replayed through the model and the engine.
- analyzer a solver's word, not yet a proof, and said so.
- undecided no answer within the solver's limit, or a witness that did not replay: no claim, with the reason.
Each report also names what it assumes of real events (an event has a direction, a process has a name) and where each premise comes from: the engine's source or the kernel's contract. You dispute a named premise, not the model.
Where it runs
On your machines: one executable and an off-the-shelf solver. Your rules never leave your site. With the engine at hand, every witness is also replayed through it; either way, the report says which.
How the model is kept honest
Each language's model is tested against its engine, on every published rule set in its history and on generated rules and events at the edges. For one engine, the coverage of that test is itself a theorem: every shape the language admits is exercised, not sampled.
Send us your rules
attesta is in early alpha. To try it on your rules, or just to talk, write to us at info@proofinity.it.