Nox
Go-based IDS with MITRE ATT&CK mapping
One event.
Three ways to read it.
From Engine.EvaluateEvent. Each stage can append alerts; the correlation rules also receive the alerts already collected.
model.Event
- 01 / STATELESS
Match
EvaluateYAMLRuleEvent type + YAML conditions
- 02 / STATEFUL
Remember
rule.Evaluate(event, e.state)Event + shared state
- 03 / CORRELATION
Connect
triggeredAlertsEvent + collected alerts + shared state
[]model.Alert
Nox is an intrusion detection system built around a stateful rules engine and explicit MITRE ATT&CK mapping. It turns raw network activity into structured detection records that can be inspected, measured, and integrated with other systems.
The project explored how a focused security tool can remain understandable while still exposing useful operational telemetry.
detect
Evaluate network events against a stateful rules engine.
contextualize
Map detections to MITRE ATT&CK techniques for a clearer operational picture.
observe
Expose structured logs, Prometheus metrics, and gRPC interfaces.
Core implementation complete and retained as an archived proof of work.
Revisit only when a new detection experiment requires the existing foundation.