Enhance detection logic to include process-based suspicious connection checks and refine firewall rule attributes in eliminate package. Add PID-to-process name mapping functionality.

2025-10-11 19:49:21 -04:00
parent a5d3623a72
commit bde1b23753
2 changed files with 92 additions and 15 deletions
@@ -21,16 +21,16 @@ func EliminateConnection(dst string) error {

 	// Add a block rule for the destination
 	return fw.AddRule(firewall.FirewallRule{
-		Name:          fmt.Sprintf("Block Outgoing %s", dst),
-		Direction:     "outbound",
-		Protocol:      "*",
-		LocalPort:     "",
-		RemotePort:    "",
-		LocalAddress:  "",
-		RemoteAddress: "%s",
-		Action:        "block",
-		Profile:       "",
-		Destination:   dst,
-		Source:        "",
+		Name:                fmt.Sprintf("Block Outgoing %s", dst),
+		Direction:           "outbound",
+		Protocol:            "*",
+		LocalPort:           "",
+		RemotePort:          "",
+		LocalAddress:        "",
+		RemoteIPAddresses:   "",
+		Action:              "block",
+		Profile:             "",
+		DestinationHostname: dst,
+		Source:              "",
 	})
 }