Tags: dogadmin/LinIR
Tags
Rewrite README: compact layout, commands grouped together, capabiliti… …es documented - Chinese README 729→334 lines (-54%), English 382→209 lines (-45%) - All commands consolidated into one "Command Reference" section with tables (was scattered across 400+ lines with repeated examples) - Quick Start section at the top for immediate use - Scoring section condensed with link to FEATURES.md for full rules - New Capabilities output section - Typical workflows reduced to a single compact code block - Architecture diagram updated (suppress, combo, capabilities) - Removed redundant output field descriptions (in FEATURES.md now) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Fix darwin build: remove stray closing brace in conntrack_darwin.go Line 274 had an orphan '}' after the emit one-liner, causing "non-declaration statement outside function body" on darwin builds. Local Windows build didn't catch it due to build tag skipping. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Update English README to match Chinese version for v0.0.3 - Add three-tier IOC monitoring documentation - Add --host flag and domain IOC support - Add network collection details (dual-source macOS, IPv4 normalization) - Add conntrack dependency, update known limitations Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Resolve domain IOCs to IPs at load time for connection matching Domain IOCs (evil.com) are now DNS-resolved via net.LookupHost() at load time. Resolved IPs are added to the IP IOC map with type "domain_resolved" and the original domain as the value. This enables matching connections by IP even when the IOC was specified as a domain. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>