-
Notifications
You must be signed in to change notification settings - Fork 56
Detector: Admin/config change without a corresponding event #789
Copy link
Copy link
Open
Labels
GrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardarea: core-enginesanctifier-core static analysis enginesanctifier-core static analysis enginedetectorNew or improved static-analysis detectorNew or improved static-analysis detectordifficulty: beginnerGood first issue, ~1-4 hrsGood first issue, ~1-4 hrsdifficulty: easyGood first issue, ~1-4 hrsGood first issue, ~1-4 hrsobservabilityLogs, metrics, tracing, monitoringLogs, metrics, tracing, monitoringtype: featureNew capability or enhancementNew capability or enhancement
Description
Activity
Metadata
Metadata
Assignees
Labels
GrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardarea: core-enginesanctifier-core static analysis enginesanctifier-core static analysis enginedetectorNew or improved static-analysis detectorNew or improved static-analysis detectordifficulty: beginnerGood first issue, ~1-4 hrsGood first issue, ~1-4 hrsdifficulty: easyGood first issue, ~1-4 hrsGood first issue, ~1-4 hrsobservabilityLogs, metrics, tracing, monitoringLogs, metrics, tracing, monitoringtype: featureNew capability or enhancementNew capability or enhancement
Summary
Add a static-analysis detector for admin/config change without a corresponding event.
Background & Problem
Privileged config changes that emit no event are invisible to monitors and audits.
Acceptance Criteria
Technical Notes
Follow the rule pattern in
tooling/sanctifier-core/src/rules/with aninstagolden snapshot.Filed as part of the mainnet-readiness & world-class roadmap. Scope is intentionally small enough for one focused PR; comment to claim.