Rust multi-engine scanner (striweb-armor) with decision fusion, live EDR, YARA, package integrity, Sigma/journald heuristics, and optional eBPF — one verdict per file.
~15–25Detection engines
1 readParallel analysis
Live EDRScan · monitor · TUI
Use case
Host and fleet triage on Linux — static scan, live process/network EDR, daemon monitoring, quarantine.
Problem
Single-engine tools miss context; stitching YARA, integrity, EDR, and SIEM by hand is slow.
Outcome
One binary that fuses engines into a verdict, with live monitoring, quarantine vault, and exportable alerts.
Lab notes
Constraints
Linux-first; engines must be toggleable; large scans need memory-safe bulk mode.
Tradeoffs
Depth and coverage over a consumer GUI — CLI/TUI and SIEM-friendly outputs win.
