clawbot 860940246d Anomaly thresholds: alerts for unusual traffic, nothing refused (closes #101) ...

SWWAF_ANOMALY_CLIENT_*, _NET_*, _ASN_*, _TOTAL_* and SWWAF_WATCH_* with
SWWAF_WATCH_NETS: requests and bytes per minute and per hour, each off by
default. Every request but the health check is counted, allow-listed and
exempt ones included, in the buckets the rate limits use; a count over its
threshold raises an anomaly alert, with a cooldown per scope. At most
20,000 counters, kept in alerts.json. A per-AS-number threshold with
lookups off, or a malformed SWWAF_WATCH_NETS, stops the start.

Judgement call: refused requests are counted too.
Judgement call: per-client counters are kept in alerts.json, which SPEC.md does not list.
Judgement call: a request counts for an AS number only if the lookup answered before it ended.

Model: opus-5-5

2026-10-07 13:04:15 +00:00

..

state_test.go

Anomaly thresholds: alerts for unusual traffic, nothing refused (closes #101)

2026-10-07 13:04:15 +00:00

state.go

Anomaly thresholds: alerts for unusual traffic, nothing refused (closes #101)

2026-10-07 13:04:15 +00:00

write_internal_test.go

Take in an admin's edits of the state files while running (closes #68)

2026-10-06 14:18:13 +02:00