Notification rollup digests and a Docker container sensor - #4
Merged
Merged
Conversation
A busy supervised session can fire many individual alerts from one process tree within minutes; NotificationRollup lets the first few notifications per tree root deliver individually within a window, then collapses further ones into one continuously-updated digest, while critical severity always bypasses digesting and never touches the budget. Co-Authored-By: Claude Fable 5 <[email protected]>
…ivity
Argus polls the host process table, but containers run inside Docker's
Linux VM, so host ps only ever sees the docker CLI and VM helper —
container start/exec activity is otherwise invisible. This adds a third,
independent sensor (alongside ProcessMonitor and PersistenceWatcher) that
subscribes to `docker events --format {{json .}}`, classifying container
start (T1610/info) and exec_start (T1609/watch) into synthetic
ProcessEvents fed through ProcessMonitor.ingestExternal. Scope is
deliberately honest and narrow: only daemon-reported container lifecycle
is visible, not processes running inside a container. Inert and silent
(beyond one log line) when no docker CLI is found; retries with a fixed
60s backoff if the daemon isn't running yet, so Docker Desktop starting
later is picked up without an app restart.
Co-Authored-By: Claude Fable 5 <[email protected]>
Updated README to cover two merged detection enhancements: notification rollups that collapse busy process trees' sub-critical alerts into digests (keeping critical alerts individual), and a new Docker events subscriber surfacing container lifecycle as synthetic events. Also increased test count from 170 to 210 tests and updated the project layout tree to include the new modules and test suites. Co-Authored-By: Claude Fable 5 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Completes the remaining two options from the agent-activity assessment.
Notification rollup digests
A busy process tree (e.g. one AI-agent session) no longer produces unbounded notification spam. Per tree root, the first 3 sub-critical notifications in a rolling 5-minute window deliver individually; after that they collapse into a single digest notification ("N alerts, techniques: … since 14:02") that updates in place via a stable notification identifier. Critical alerts always deliver individually and never consume the budget — a rollup is noise mitigation, not suppression. Rollups key on the process-tree root, so two agent sessions never share a digest. Feed, history, risk score, and log are unaffected.
Docker container sensor
Containers run inside Docker's Linux VM, invisible to host
ps. A long-liveddocker eventssubscriber (same external-sensor pattern as the persistence watcher) surfaces container lifecycle activity as synthetic events tagged provenance "docker": container starts (info, T1610 Deploy Container) and execs into running containers (watch, T1609 Container Administration Command). Resilient to the daemon coming and going (60s retry, one log line per transition), inert without a docker CLI. Honest scope: only what the daemon reports — processes inside containers remain invisible; in-container detection is a different tool's job.Verification
Test suite 170 → 210, all green. Live-verified against the real Docker daemon (v29.4.0): a container start surfaced as info/T1610 with docker provenance; a
docker execinto a running container surfaced as watch/T1609 with the exec command line; and the retry path was exercised for real — the subscriber was killed mid-test, logged its exit, backed off 60s, and resumed capturing events without an app restart. Rollup semantics are covered by unit tests (digests only engage for sub-critical notifications past the per-window budget, which requires a lowered notification threshold to observe live).🤖 Generated with Claude Code