PRJ-002 / ENGINEERING BRIEF
nox
Go-based IDS with MITRE ATT&CK mapping
RECORD PRJ-002
STATUS COMPLETE
INITIATED 2025
CLASS SOFTWARE
INDEX TERMS
goidsdetectionmitre
PROJECT DOSSIER / NOX
PRJ-002
MISSION
Nox is an intrusion detection system built around a stateful rules engine and explicit MITRE ATT&CK mapping. It turns raw network activity into structured detection records that can be inspected, measured, and integrated with other systems.
The project explored how a focused security tool can remain understandable while still exposing useful operational telemetry.
SYSTEM ARCHITECTURE
FLOW / PRIMARY
01
NETWORK EVENT
02
STATEFUL RULES
03
ATT&CK MAPPING
04
STRUCTURED LOG
05
METRICS OUTPUT
CAPABILITIES
3 MODULES
detect
Evaluate network events against a stateful rules engine.
contextualize
Map detections to MITRE ATT&CK techniques for a clearer operational picture.
observe
Expose structured logs, Prometheus metrics, and gRPC interfaces.
DEVELOPMENT STATUS
COMPLETE
CURRENT PHASE
Core implementation complete and retained as an archived proof of work.
NEXT DIRECTIVE
Revisit only when a new detection experiment requires the existing foundation.