Plugins / Plugin API
Plugin API
A plugin subscribes to one or more event types and receives each record with a context object for tagging, notes and case actions.
Handlers run in the order they were registered.
Python
from neutrality import plugin, events, store
RARE = store.counter("parent_child_pairs", window="30d")
@plugin.on(events.ProcessCreate)
def rare_parent(ev, ctx):
pair = (ev.parent.name, ev.process.name)
if RARE.seen(pair) > 3:
return
ctx.tag(ev, "rare-parent")
ctx.note(ev, f"{pair[0]} -> {pair[1]} seen {RARE.seen(pair)}x in 30d")