Merge pull request #2 from lazypwny751/main

base

Author: lazypwny751

.github/workflows/ci.yml

@@ -0,0 +1,15 @@
+name: Oburix CI.
+
+on: [push, pull_request]
+
+jobs:
+  shellcheck:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout repo
+      uses: actions/checkout@v4
+
+    # Lint for shell scripts.
+    - name: Run ShellCheck
+      uses: ludeeus/action-shellcheck@master

.gitignore

@@ -0,0 +1 @@
+/target

Cargo.lock

@@ -0,0 +1,6 @@
+[package]
+name = "oburix"
+version = "0.1.0"
+edition = "2024"
+
+[dependencies]

Cargo.toml

@@ -11,6 +11,17 @@
 - 🔥 Lightweight, low-overhead architecture  
 - 📦 Integrates easily into SIEM/XDR pipelines  
 
+## 🏗️  Development setup.
+```
+git clone https://github.com/ByCh4n-Group/oburix.git && cd oburix
+```
+
+```
+cd runtime
+mkdir -p "build" && cd "build"
+cmake .. && make
+```
+
 ## 📦 Installation
 
 Coming soon.  
@@ -30,20 +41,7 @@ Oburix uses eBPF to observe system-level events without intrusive kernel modules
 Detection behavior is defined through simple YAML-based rules:
 
 ```yaml
-rules:
-  - id: suspicious-port
-    type: network
-    condition:
-      dst_port: 4444
-      protocol: tcp
-    action: alert
-
-  - id: sensitive-file-read
-    type: file
-    condition:
-      path: "/etc/passwd"
-      access: read
-    action: alert
+...
 ```
 
 ## 🚧 Status

README.md

@@ -0,0 +1 @@
+build/

rules/README.md

@@ -0,0 +1,14 @@
+cmake_minimum_required(VERSION 3.0)
+project(oburix_runtime C)
+
+set(CMAKE_C_COMPILER clang)
+
+set(CMAKE_C_STANDARD 99)
+
+set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -O2 -g -Wall -target bpf")
+
+include_directories(${CMAKE_SOURCE_DIR}/include)
+
+file(GLOB SOURCES ${CMAKE_SOURCE_DIR}/src/*.c)
+
+add_executable(bpf_program ${SOURCES})