poc3

app/ndr.py

@@ -188,6 +188,7 @@ class NDRAnalyzer:
         auto_block: bool = False,
         auto_block_risk: int = 92,
         notifier: Any | None = None,
+        block_evidence_callback: Any | None = None,
     ) -> None:
         self.store = store
         self.threat_intel = threat_intel
@@ -201,6 +202,7 @@ class NDRAnalyzer:
         self.auto_block = auto_block
         self.auto_block_risk = max(70, min(100, int(auto_block_risk)))
         self.notifier = notifier
+        self.block_evidence_callback = block_evidence_callback
         self._queue: queue.Queue[tuple[dict[str, Any], int | None]] = queue.Queue(maxsize=20000)
         self._stop = threading.Event()
         self._thread = threading.Thread(target=self._run, name="ndr-analyzer", daemon=True)
@@ -467,6 +469,11 @@ class NDRAnalyzer:
                 result = self.routeros.block_ip(target, self.block_timeout, f"MikroSuricata NDR risk {combined_risk}: {summary}"[:220])
                 if result.success:
                     self.store.mark_incident_blocked(incident_id, target)
+                    if self.block_evidence_callback is not None:
+                        try:
+                            self.block_evidence_callback(target, f"ndr-{incident_id}")
+                        except Exception as exc:
+                            print(f"[ndr] forensic PCAP capture failed: {exc}", flush=True)
 
     def _subject(self, record: dict[str, Any]) -> str:
         src = str(record.get("src_ip") or record.get("dhcp_assigned_ip") or record.get("arp_src_ip") or "")