[GH-ISSUE #161] Changed-behavior ignores interaction and shim dimensions when generating findings #107

New issue

Closed

opened 2026-10-15 18:21:13 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:21:13 +00:00

Owner

Originally created by @morluto on GitHub (Jul 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/161

Problem

In processFindings, process comparisons materialize findings only for five dimensions (terminal, exit, filesystem, protocol, process).

process_capture comparisons can return interaction and shim dimensions, but these are dropped before output:

src/domain/changedBehavior.ts in processFindings uses a fixed dimension set at lines around 274-280.
This means downstream changed-behavior aggregation never receives findings for interaction or shim status changes/unknowns.

Confirmed behavior

processCaptureComparisonSchema includes both interaction and shim dimensions.
A compare_process_captures result with only interaction or shim changed will carry a non-unchanged status at result level.
processFindings returns no finding for those dimensions, so this class of regression is absent from findChangedBehavior output.

Impact

Runtime observations in process interaction or shim behavior are hidden from changed-behavior reports.
observed_changes counts can underreport because dimension-level findings are missing.
Analysts lose an actionable signal path for interaction/shim differences.

Expected behavior

Include interaction and shim in processFindings with appropriate scope mapping.
Preserve existing status-to-classification behavior (observed_change vs unresolved_branch).

Suggested fix

Extend the dimension list in processFindings to include interaction and shim.
Add regression tests for findChangedBehavior where only these dimensions diverge.

Files

src/domain/changedBehavior.ts

Originally created by @morluto on GitHub (Jul 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/161 ## Problem In `processFindings`, process comparisons materialize findings only for five dimensions (`terminal`, `exit`, `filesystem`, `protocol`, `process`). `process_capture` comparisons can return `interaction` and `shim` dimensions, but these are dropped before output: - `src/domain/changedBehavior.ts` in `processFindings` uses a fixed dimension set at lines around `274-280`. - This means downstream changed-behavior aggregation never receives findings for `interaction` or `shim` status changes/unknowns. ## Confirmed behavior - `processCaptureComparisonSchema` includes both `interaction` and `shim` dimensions. - A `compare_process_captures` result with only `interaction` or `shim` changed will carry a non-`unchanged` status at result level. - `processFindings` returns no finding for those dimensions, so this class of regression is absent from `findChangedBehavior` output. ## Impact - Runtime observations in process interaction or shim behavior are hidden from changed-behavior reports. - `observed_changes` counts can underreport because dimension-level findings are missing. - Analysts lose an actionable signal path for interaction/shim differences. ## Expected behavior - Include `interaction` and `shim` in `processFindings` with appropriate scope mapping. - Preserve existing status-to-classification behavior (`observed_change` vs `unresolved_branch`). ## Suggested fix - Extend the dimension list in `processFindings` to include `interaction` and `shim`. - Add regression tests for `findChangedBehavior` where only these dimensions diverge. ## Files - `src/domain/changedBehavior.ts`

bsakaguchi

2026-10-15 18:21:13 +00:00