poc3

app/eve.py

@@ -6,6 +6,7 @@ import threading
 import time
 from typing import Any
 
+from .forensics import ForensicPcapRing
 from .live import LiveEventPipeline, TrafficNormalizer, is_dashboard_noise
 from .ndr import NDRAnalyzer
 from .policy import PolicyEngine
@@ -30,6 +31,7 @@ class EVEWatcher(threading.Thread):
         normalizer: TrafficNormalizer | None = None,
         live_pipeline: LiveEventPipeline | None = None,
         ndr_analyzer: NDRAnalyzer | None = None,
+        forensic_pcap: ForensicPcapRing | None = None,
     ) -> None:
         super().__init__(name="eve-watcher", daemon=True)
         self.path = path
@@ -44,6 +46,7 @@ class EVEWatcher(threading.Thread):
         self.normalizer = normalizer
         self.live_pipeline = live_pipeline
         self.ndr_analyzer = ndr_analyzer
+        self.forensic_pcap = forensic_pcap
         self._initial_seek_done = False
 
     def run(self) -> None:
@@ -137,6 +140,12 @@ class EVEWatcher(threading.Thread):
             blocked = result.success
             reason = result.message if result.success else f"{decision.reason}; {result.message}"
             self.stats.inc("block_success" if result.success else "block_errors")
+            if result.success and self.forensic_pcap is not None:
+                try:
+                    self.forensic_pcap.capture_target(decision.target, label=f"sid-{sid}")
+                except Exception as exc:
+                    self.stats.inc("forensic_pcap_errors")
+                    print(f"[forensics] block PCAP capture failed: {exc}", flush=True)
 
         incident_id = self.store.insert_alert(event, blocked, decision.target, reason)
         self._publish_live(