Function format_malfind_csv

src/os/linux/csv_export.cpp:127–152

ByteBuf format_udp_csv(const Engine& eng) { return format_socket_csv(eng, SocketInfo::P_UDP, "UDP"); }

ByteBuf format_malfind_csv(const Engine& eng) {
    std::string out;
    out.reserve(16 * 1024);
    out += "pid,comm,vm_start,vm_end,size,perms,severity,reason\r\n";
    for (const auto& p : eng.processes()) {
        std::vector<MalfindHit> hits;
        try { hits = find_malfind(eng, p); } catch (...) { continue; }
        for (const auto& h : hits) {
            char perm[4] = {
                (h.vm_flags & 1) ? 'r' : '-',
                (h.vm_flags & 2) ? 'w' : '-',
                (h.vm_flags & 4) ? 'x' : '-',
                0
            };
            out += fmt::format("{},{},{:#x},{:#x},{},{},{},{}\r\n",
                               p.pid,
                               csv_quote(p.comm),
                               h.vm_start, h.vm_end,
                               h.vm_end - h.vm_start,
                               perm,
                               h.high_severity ? "HIGH" : "INFO",
                               csv_quote(h.reason));
        }
    }
    return ByteBuf(out.begin(), out.end());
}

ByteBuf format_findevil_csv(const Engine& eng) {
    // Single-row CSV: per-check counts. Wide schema for SIEM ingest —