Multiply defensive capabilities: KQL/Splunk/EQL/YARA rules + STIX/MISP export + beacon analysis + campaign analytics

[cognis-digital]

Multiply c2detect's defensive capabilities

Substantial new blue-team / DFIR / threat-intel features that multiply what c2detect does — all fully offline (bundled fixtures, no live network), additive to the public API, with matching tests, runnable demos, and docs. Strictly detection/defensive: no offensive C2, no evasion tooling.

Based on feature/depth-4x-tests-demos-hardening (PR #6). Targets that branch so the diff shows only the new work; if #6 merges first, retarget to main.

New features

1. Four new detection-rule targets (c2detect rules --format …), alongside the existing Sigma/Suricata:

• KQL — Microsoft Sentinel / Defender hunting queries (let indicator sets + union … | where).
• Splunk SPL — correlation searches (search … | stats …).
• Elastic EQL — ECS-field queries (tls.client.ja3, url.path, …).
• YARA — rules over C2 config/network strings (cert quirks, banners, default URIs/UAs) for memory images / unpacked implants.

All carry the same attack.command_and_control / T1071.001 annotations. Interpolated values are backslash/double-quote-escaped so a user-extended signature DB can never emit a broken or injectable rule.

2. STIX 2.1 + MISP export (new c2detect export): native, zero-dependency emitters.

• STIX bundle: indicator + malware SDOs with kill-chain phases and indicates relationships; STIX-patterning expressions over network-traffic / x509 / url properties. Backslash/single-quote-safe; non-numeric ports dropped.
• MISP event: one attribute per indicator, family + ATT&CK galaxy tags, threat-level from worst severity.
• --db exports the whole signature DB as a standalone, shareable C2-fingerprint STIX feed.

3. Beacon-cadence analysis (new c2detect beacon): derives beacon statistics from raw connection timestamps (Zeek conn.log / proxy / EDR; epoch or ISO-8601) — mean/median interval, jitter as a scale-free coefficient of variation, a regularity score, and a verdict (beacon / jittered-beacon / irregular / insufficient-data). --fail-on-beacon CI/hunt gate. Multi-field lines prefer the fractional (Zeek ts) epoch so a leading byte-count/uid isn't mistaken for the timestamp.

4. Campaign graph analytics (c2detect correlate --format json --analytics): per-campaign hub host (highest degree), density, linchpin pivot (heaviest shared value), and ATT&CK rollup — the numbers an IR lead uses to decide what to pull and what to block first.

5. MCP surface grows: export, beacon, and generate_rules tools added to the stdio JSON-RPC server.

Demos, docs, versioning

• 4 new offline demo scenarios (21_beacon_timeseries, 22_stix_misp_export, 23_multi_siem_rules, 24_campaign_analytics) + a beacon-timeseries fixture; wired into run_all.py and the demo test list (now 24).
• README: new "Share as threat intel", "Beacon-cadence analysis" sections; rules section covers all six dialects; correlate section documents --analytics; --help/version examples refreshed.
• Version 1.4.0 → 1.5.0.

Public API (additive)

New exports: to_kql, to_splunk, to_eql, to_yara, to_misp, to_stix, signatures_to_stix, campaign_analytics, analytics, BeaconAnalysis, analyze_timestamps, analyze_beacon_text, parse_timestamps. All previous exports retained; pinned by tests/test_public_api.py.

Tests

973 → 1093 (+120), all green offline (python -m pytest -q). Includes escaping/robustness regression tests surfaced by an internal code review (quote/backslash breakout in the new generators; non-numeric STIX ports; multi-field timestamp parsing).

Every demo exits 0 under PYTHONUTF8=1.