Stop the watchdog observer and close file handles.

Generate composite fingerprint key based on level.

Map a unified threat score to a severity label

Extract raw IP and normalized IP from request Returns tuple of (raw_ip, normalized_ip)

Return a random password of the given length All character-pool flags after `length` are keyword-only (the * in the signature). That kee

Filter by port number (source or destination)

Split data into train/val/test with SMOTE on training set only

Register a beacon connection in memory and upsert to database

Save the PDF with cleaned metadata to the output path. Creates a copy of the original file and rebuilds the PDF with the wip

Determine if an event passes all active filters

Decode an XOR+Base64 string into a validated Message

Compare returns -1, 0, or 1 following PEP 440 ordering rules. The ordering within a given release segment is: 1.0.dev1 < 1.0a1 < 1.0b1 < 1.0rc1 < 1

Serialize a TracerEvent to a JSON-compatible dict

Encode a plaintext payload: UTF-8 bytes -> XOR -> Base64 string

Extract authentication identifier using fallback chain Order: JWT -> API Key (header) -> API Key (query) -> Session -> None

Generate SARIF 2.1.0 report as JSON string

Parse rate limit string like '100/minute' or '1000/hour'

Calculate Shannon entropy in bits per byte

Persist a task to SQLite and enqueue it for beacon delivery

Transform features using the fitted scaler parameters.

Open an existing vault at `path` using the master password Reads the file, parses the envelope, derives the key from the pas

Tiny convenience wrapper that always uses TEST_KDF_PARAMETERS The whole point of test fixtures is to keep noise out of test bodies — thi

Shorthand for record_and_aggregate with sensible defaults.

Validate SSN area, group, and serial numbers

Analyze a single DNS query for exfiltration

Check and increment counter using fixed window algorithm

Check and increment counter using sliding window algorithm

Attempt to consume tokens from bucket

Format byte count with appropriate unit

Async context manager yielding a database connection

Get DOCX test file path as string.

Get JPG test file path as string.

Get PPTX test file path as string.

Identify application-layer protocol via DPI

Create a bidirectional flow key from a packet

Parse an nginx combined-format log line using string-split primary with compiled regex fallback.

Run all 3 models on a batch of feature vectors. Returns per-model raw scores for ensemble fusion, or None if models are not

Extract metadata properties from the PowerPoint presentation. Reads all document properties from the presentation and identifies

Extract metadata properties from the Excel workbook. Reads all document properties from the workbook and identifies which pr

Extract metadata properties from the Word document. Reads all document properties and identifies which properties should be