Arynox NetScope Extensions
==========================

NetScope supports safe manifest-based extensions.

Supported extension locations:
1. User extensions:
   %AppData%\Arynox\NetScope\Extensions

2. Portable/package extensions beside the app EXE:
   Extensions\

Supported manifest file names:
- extension.json
- plugin.json
- *.netscopeext

What a safe extension can do in this build:
- Add or enable alert rules.
- Add capture profiles.
- Run supported NetScope actions such as traffic_summary.
- Open a trusted documentation URL.

What it cannot do in this build:
- Load external DLL files.
- Execute arbitrary scripts or commands.
- Run hidden background code.

This keeps extensions useful while avoiding unsafe code execution until signed and sandboxed extensions are implemented.

Example manifest fields:
{
  "id": "example-extension",
  "name": "Example Extension",
  "type": "Analyzer",
  "version": "1.0.0",
  "description": "Adds rules and a capture profile.",
  "enabled": true,
  "alert_rules": [
    { "rule": "port: 3389", "severity": "High", "message": "RDP detected" }
  ],
  "capture_profiles": [
    {
      "name": "Extension - RDP Watch",
      "focus": "RDP monitoring",
      "filter": "port: 3389",
      "alert_bias": "RDP alerts",
      "description": "Focus on remote desktop traffic."
    }
  ],
  "actions": [
    { "type": "traffic_summary" }
  ]
}
