PRJ-002 / SOFTWARE

Nox

Go-based IDS with MITRE ATT&CK mapping

RECORD PRJ-002 STATUS COMPLETE STARTED 2025 CLASS SOFTWARE
INDEX TERMS goidsdetectionmitre
ENGINE / EVALUATION ORDER

One event.
Three ways to read it.

From Engine.EvaluateEvent. Each stage can append alerts; the correlation rules also receive the alerts already collected.

model.Event

  1. 01 / STATELESS

    Match

    EvaluateYAMLRule

    Event type + YAML conditions

  2. 02 / STATEFUL

    Remember

    rule.Evaluate(event, e.state)

    Event + shared state

  3. 03 / CORRELATION

    Connect

    triggeredAlerts

    Event + collected alerts + shared state

[]model.Alert

internal/rules/engine.go · 21253c44 ↗
PROJECT / NOX PRJ-002
OVERVIEW

Nox is an intrusion detection system built around a stateful rules engine and explicit MITRE ATT&CK mapping. It turns raw network activity into structured detection records that can be inspected, measured, and integrated with other systems.

The project explored how a focused security tool can remain understandable while still exposing useful operational telemetry.

CURRENT IMPLEMENTATION 3 AREAS
01

detect

Evaluate network events against a stateful rules engine.

02

contextualize

Map detections to MITRE ATT&CK techniques for a clearer operational picture.

03

observe

Expose structured logs, Prometheus metrics, and gRPC interfaces.

DEVELOPMENT STATUS COMPLETE
CURRENT STATUS

Core implementation complete and retained as an archived proof of work.

NEXT STEPS

Revisit only when a new detection experiment requires the existing foundation.