clawguard-threat-detect

Real-time behavioral monitoring detects runtime threats in OpenClaw by tracking commands, file access, network activity, and prompts. It applies deterministic rule-based detections and MITRE ATT&CK mappings to identify malicious activity during active sessions.

MITRE ATT&CK mapping for runtime security correlates observed file access, network activity, and prompts with known adversary tactics and techniques. This provides structured threat context to identify and respond to malicious activity during active sessions.

You can configure anomaly detection to block malicious commands automatically by enabling optional auto-block hooks. The system applies adaptive threat scoring and configurable thresholds to block, alert, or log suspicious behaviors during active sessions.

OpenClaw threat detection supports self-learning through optional hooks designed for continuous improvement and incident learning. These hooks adapt anomaly detection and threat scoring based on ongoing runtime security events and observed behaviors.

Configure alert and block thresholds for AI safety behavioral monitoring using configurable settings for blocking, alerting, and logging. These thresholds determine when adaptive threat scoring triggers automated responses during active OpenClaw sessions.

Limitations of rule-based detections include blind spots for novel attack vectors not covered by existing rules. The system mitigates this by supplementing deterministic rules with anomaly detection and self-learning hooks to identify unusual prompts and network activity.