Rules Engine¶

ThreatDeflect uses the rules.yaml file to control all detection logic. This file defines what is analyzed, what is ignored, and how each finding is classified.

rules.yaml structure¶

The file has 4 main sections:

1. ignore_patterns¶

Defines directories and files that should not be analyzed.

• directories: folders such as node_modules/, .venv/, dist/, docs/
• files: lock files, configs without secrets, binaries, media, known libraries

2. file_scan_targets¶

Defines what the scanner should actively look for.

• interesting_extensions: extensions that may contain secrets (.py, .js, .yml, .env, .tf, etc.)
• dependency_files: dependency files (package.json, requirements.txt, Cargo.toml, etc.)
• sensitive_filenames: files with high probability of containing secrets (.env, credentials.json, id_rsa, etc.)

3. severity_map¶

Maps each detection rule to a severity level:

4. rules¶

List of detection rules, each with an id and a pattern (regex).

Detection Rules¶

Credentials and Tokens (CRITICAL)¶

Webhooks and Exfiltration (CRITICAL)¶

Execution and Backdoors (HIGH)¶

Persistence (MEDIUM)¶

Weak Indicators (LOW)¶

Calibration¶

Reducing false positives¶

If the scanner is generating too much noise in your project:

1. Add specific directories to ignore_patterns.directories
2. Add files to ignore_patterns.files
3. Adjust rule patterns to require more context

Adding custom rules¶

To add a new rule:

rules:
  - id: Minha Regra Custom
    pattern: '(?i)(meu_padrao)\s*[:=]\s*["''][a-zA-Z0-9]{32}["'']'

Then add the severity mapping:

severity_map:
  Minha Regra Custom: HIGH