Guardian Runtime — Drift Detection & SIEM Export

dotnet add package CipherShift365.Guardian

using CipherShift365.Guardian.Runtime;

// Create components
var drift = new DriftEngine(identityService);
var sampling = new SamplingController(maxEventsPerSecond: 1000);
var health = new HealthMonitor();
health.OnFault += e => Console.Error.WriteLine($"GUARDIAN FAULT: {e.Description}");

// Load baseline
drift.LoadBaseline(signedBaseline);

// Configure SIEM export
var listener = new RuntimeListener(drift, sampling, health, onEvent: canonicalEvent =>
{
    // Send to SIEM
    await siemClient.SendAsync(EventExporter.ToSentinelJson(canonicalEvent));
});

listener.Start();

<ItemGroup>
  <RuntimeHostConfigurationOption Include="STARTUP_HOOKS"
    Value="path\to\CipherShift365.Guardian.Runtime.dll" />
</ItemGroup>

CipherShift365.Guardian
  ├── CipherShift365.Core.Analysis
  └── CipherShift365.Core.Runtime (shared contracts + types)

// Setup (once at startup)
var drift = new DriftEngine(identityService);
var sampling = new SamplingController(500); // 500 events/sec
var health = new HealthMonitor();

var listener = new RuntimeListener(drift, sampling, health, onEvent: evt =>
{
    // Log to console, file, or SIEM
    Console.WriteLine($"[DRIFT] {evt.Category}: {evt.Algorithm} — {evt.Description}");
});

listener.Start();

// No further interaction needed — listener runs for the process lifetime

var listener = new RuntimeListener(drift, sampling, health, onEvent: evt =>
{
    string json = targetSiem switch
    {
        "sentinel" => EventExporter.ToSentinelJson(evt),
        "splunk"   => EventExporter.ToSplunkJson(evt),
        "elastic"  => EventExporter.ToElasticJson(evt),
        _          => JsonSerializer.Serialize(evt)
    };

    // Send via your SIEM agent's forwarder
    siemForwarder.Send(json);
});

// Periodically check if Guardian has faulted
if (health.IsFaulted)
{
    Console.Error.WriteLine(
        $"Guardian disabled at {health.LastFaultAt} after {health.FaultCount} faults. " +
        "Host continues normally but drift detection is unavailable until reset.");
}

// Load the same signed baseline used by Guardian Gate
byte[] blob = File.ReadAllBytes("baseline.csb");
var sb = BaselineManager.ImportFromDistribution(blob, verifier);
if (sb is null) throw new SecurityException("Baseline rejected.");

drift.LoadBaseline(sb);

{
  "TimeGenerated": "2026-06-29T12:00:00.000Z",
  "AssetId": "crypto-ml-dsa-87",
  "Algorithm": "ML-DSA-87",
  "Severity": "QuantumSafe",
  "Category": "NewFinding",
  "CorrelationId": "a1b2c3d4",
  "Description": "New crypto asset detected: ML-DSA-87 (Signature)",
  "Source": "CipherShift365.Guardian"
}

{
  "timestamp": "2026-06-29T12:00:00.000Z",
  "event": "pqc_drift",
  "fields": {
    "asset_id": "crypto-ml-dsa-87",
    "algorithm": "ML-DSA-87",
    "severity": "QuantumSafe",
    "category": "NewFinding",
    "correlation_id": "a1b2c3d4"
  }
}

{
  "@timestamp": "2026-06-29T12:00:00.000Z",
  "event": {
    "action": "pqc_drift",
    "category": "NewFinding",
    "severity": 3
  },
  "asset": {
    "id": "crypto-ml-dsa-87",
    "algorithm": "ML-DSA-87"
  },
  "ciphershift": {
    "correlation_id": "a1b2c3d4"
  }
}

RuntimeListener (IDisposable)
  ├── Constructor: DriftEngine, SamplingController, HealthMonitor, Action<CanonicalEvent>?
  ├── Start()              — Subscribes to DiagnosticListener.AllListeners
  ├── ProcessCryptoEvent() — Core event processing pipeline
  └── Dispose()            — Unsubscribes all listeners

CryptoDiagnosticObserver : IObserver<DiagnosticListener>
  ├── OnNext()   — Filters for CipherShift365 / ASP.NET sources
  └── Subscribes CryptoEventObserver for crypto-related events

CryptoEventObserver : IObserver<KeyValuePair<string, object?>>
  └── Forwards to RuntimeListener.ProcessCryptoEvent()

DriftEngine
  ├── Constructor: IIdentityService
  ├── LoadBaseline(SignedBaseline)
  ├── Evaluate(Finding) → DriftResult
  └── GetCurrentBaseline() → Baseline?

SamplingController
  ├── Constructor: int maxEventsPerSecond (default 1000)
  ├── ShouldProcess() → bool
  ├── IsSampling : bool
  └── SampleCount : int

HealthMonitor
  ├── IsFaulted : bool  (true after 3 consecutive faults)
  ├── FaultCount : int
  ├── LastFaultAt : DateTimeOffset?
  ├── OnFault : event Action<CanonicalEvent>
  ├── RecordFault(string reason)
  ├── TryEnter() → bool
  └── Reset()

CanonicalEvent (record)
  ├── EventId, AssetId, Algorithm, Severity, Category
  ├── CorrelationId, Timestamp
  └── FindingLocationalId?, BaselineLogicalId?, ObservedLogicalId?, Description?, RecommendedAction?

EventExporter (static)
  ├── ToSentinelJson(CanonicalEvent) → string
  ├── ToSplunkJson(CanonicalEvent)   → string
  └── ToElasticJson(CanonicalEvent)  → string

DriftResult (readonly record struct)
  ├── HasDrift : bool, Category : DriftCategory
  ├── LogicalId, Algorithm, Description
  ├── Risk, Confidence
  └── Static factories: NewFinding(), RiskChanged(), ConfidenceChanged(), NoDrift(), BaselineNotLoaded()

1. HealthMonitor.TryEnter()
   └─ If faulted → drop event immediately
   
2. SamplingController.ShouldProcess()
   └─ If sampling → drop event, record sample count
   
3. Extract algorithm from CryptoEvent
   └─ If null → return (no-op for non-crypto events)
   
4. Construct Finding from event data
   └─ Maps event.Role, event.Algorithm, event.Details

5. DriftEngine.Evaluate(finding)
   └─ Computes LogicalId from (Role, Algorithm, Parameters)
   └─ Compares against baseline entries by LogicalId
   └─ Returns DriftResult with category and description
   
6. If DriftResult.HasDrift == true:
   └─ Construct CanonicalEvent
   └─ Invoke onEvent callback → SIEM export

public static class EventExporter
{
    public static string ToYourSiemJson(CanonicalEvent e)
    {
        return JsonSerializer.Serialize(new
        {
            time = e.Timestamp,
            // ... map fields to your SIEM's schema
        });
    }
}

var drift = new DriftEngine(identity);
var sampling = new SamplingController(500);
var health = new HealthMonitor();

// Self-disable on fault
health.OnFault += e => Console.Error.WriteLine($"GUARDIAN DISABLED: {e.Description}");

// Drift to console
var listener = new RuntimeListener(drift, sampling, health, onEvent: e =>
{
    Console.WriteLine($"[{e.Timestamp:HH:mm:ss}] [{e.Category}] {e.Algorithm}: {e.Description}");
    if (e.RecommendedAction is not null)
        Console.WriteLine($"  → Action: {e.RecommendedAction}");
});

listener.Start();
Console.WriteLine("Guardian Runtime active. Press any key to stop.");
Console.ReadKey();
listener.Dispose();

var drift = new DriftEngine(identity);
drift.LoadBaseline(signedBaseline);
var sampling = new SamplingController(1000);
var health = new HealthMonitor();

var httpClient = new HttpClient();
httpClient.BaseAddress = new Uri(Environment.GetEnvironmentVariable("SENTINEL_DCR_URL")!);

var listener = new RuntimeListener(drift, sampling, health, async evt =>
{
    var json = EventExporter.ToSentinelJson(evt);
    var content = new StringContent(json, Encoding.UTF8, "application/json");
    await httpClient.PostAsync("/api/logs", content);
});

listener.Start();

var listener = new RuntimeListener(drift, sampling, health, async evt =>
{
    var splunkPayload = EventExporter.ToSplunkJson(evt);
    var request = new HttpRequestMessage(HttpMethod.Post, "https://splunk-hec:8088/services/collector")
    {
        Content = new StringContent(splunkPayload, Encoding.UTF8, "application/json"),
        Headers = { { "Authorization", $"Splunk {hecToken}" } }
    };
    await httpClient.SendAsync(request);
});

// Guardian Runtime is resilient by design
var health = new HealthMonitor();
var listener = new RuntimeListener(drift, sampling, health);

// Simulate a fault in an external callback
health.OnFault += e =>
{
    // Forward the health event to your alerting system
    alertingService.SendCritical(e.Description!);

    // After 3 faults, Guardian self-disables
    // Your application continues running normally
    // Only drift detection stops — not your business logic
};

listener.Start();

// Later, if you want to reset:
if (health.IsFaulted)
{
    health.Reset();
    listener.Start(); // Re-enable monitoring
}

var listener = new RuntimeListener(drift, sampling, health, onEvent: e =>
{
    // Only alert on high-severity drift
    if (e.Severity == RiskLevel.QuantumBroken || e.Severity == RiskLevel.QuantumVulnerable)
    {
        // Send to alerting system
        pagerDuty.Trigger(new Alert
        {
            Severity = e.Severity.ToString(),
            Source = "CipherShift365.Guardian",
            Summary = e.Description ?? $"Drift: {e.Category}",
            Details = new
            {
                e.AssetId, e.Algorithm, e.CorrelationId,
                Action = e.RecommendedAction
            }
        });
    }

    // Always log to SIEM regardless of severity
    siemForwarder.Send(EventExporter.ToElasticJson(e));
});

// Default: 1000 events per second
var sampling = new SamplingController(maxEventsPerSecond: 1000);

// Low-resource environments: 100 events per second
var sampling = new SamplingController(maxEventsPerSecond: 100);

// High-throughput services: 5000 events per second
var sampling = new SamplingController(maxEventsPerSecond: 5000);

// Optional: periodic cleanup (not built-in)
if (DateTimeOffset.UtcNow - lastPurge > TimeSpan.FromHours(24))
{
    // Custom purge logic if needed
}

Q: "Has the production deployment drifted from our crypto baseline?"
A: "We don't know. We run a gate at build time. What happens at runtime is anyone's guess."
Risk: HIGH — unknown runtime behavior, no telemetry

Q: "Has the production deployment drifted from our crypto baseline?"
A: "Guardian Runtime has detected 0 drift events in the last 24 hours.
    Baseline v12 loaded, 47 crypto events processed, 0 sampling drops.
    Health: green. Full event log available in Sentinel."
Risk: LOW — continuous verification with real-time SIEM visibility