Alert Classification Pipeline¶
SafeMode uses explicit classification to keep incident triage clear and low-noise.
Goals¶
- Distinguish blocking reasons precisely.
- Avoid labeling ad/tracker events as phishing.
- Surface secrets and suspicious JS with higher severity.
Pipeline Stages¶
- Ingress
-
HTTPFlow enters request/response hooks.
-
Request typing
-
Infer document/script/xhr/media/etc from headers and URL hints.
-
Whitelist gating
-
Skip user-approved domains and selected trusted defaults.
-
Filter matching
- Run Rust adblock engine match.
-
Run PhishTank URL/domain checks (domain match configurable).
-
False-positive guards
-
Known noisy domains can bypass phishing label while still allowing other controls.
-
Reason assignment
-
Assign one of:
ublock,phishtank,secrets_detected,suspicious_patterns. -
Event normalization
-
Normalize timestamps, URL/host fields, secret payload structure, and dedupe markers.
-
UI rendering model
- Live cards group by deterministic keys.
- Severity mapping drives visual emphasis and notification behavior.
Classification Rules¶
Phishing priority¶
If phishing hit passes false-positive guard, phishtank classification is prioritized.
uBlock path¶
uBlock matches classify as ublock with category breakdown (ads/trackers/social/etc).
Secret detection path¶
Secrets in response content may neutralize JS and classify event as secrets_detected.
Suspicious JS path¶
SUSPICIOUS_JS_LEVEL decides whether suspicious bundles are only logged or actively neutralized.
Notification Channel Mapping¶
Monitor panel maps classified events to notification channels:
- phishing
- secret
- malware/suspicious
- ad
- tracker
Per-channel settings determine whether a notification is emitted.
Why This Matters¶
Without strict labels:
- Teams cannot triage quickly.
- False urgency increases alert fatigue.
- Incidents lose audit value.
With strict labels, blocked traffic remains informative and actionable.