cloudcheck optimizations

[liquidsec]

TLDR: Increases the speed of cloudcheck lookups by somewhere between 30-50%, depending on the particulars of the scan.

Summary

Three independent optimizations to cloudcheck, plus a refactor to make Event.resolved_hosts naturally immutable (which enables the inheritance fast path to be cheap and correct).

• Per-host parent inheritance — child events whose hosts are a subset of their parent's inherit the parent's per-host cloud metadata instead of re-running lookups. Iterates parent.host_metadata (only matched hosts, typically 0-1 entries) rather than the child's full hosts_to_check. Per-host attribution in host_metadata[host]['cloud_providers'] keeps tags correctly scoped: a child that doesn't have one of the parent's matching hosts does not inherit that host's tag. Regression cases for the leak invariant are in test_module_cloudcheck.py.
• YARA prefilter for storage-bucket regex — replaces the 8-regex sequential loop with a single combined YARA scan. ~95% of non-IP events have no host that could possibly match any bucket pattern; YARA returns no matches in one optimized scan and we skip the per-regex pass entirely. Also drops the per-event asyncio.Lock acquire the previous lazy regex loader used.
• LRU cache on cloudcheck.lookup() — 100K-entry per-scan cache keyed by host (~50MB target). Repeated hosts hit the cache in ~50ns instead of paying the ~30µs Future-based lookup. Subdomain-enum scans repeat backing IPs heavily (CloudFront-style fan-out), so hit rate is high.
• Event.resolved_hosts is naturally immutable — _resolved_hosts is always None or a frozenset. add_resolved_host / update_resolved_hosts removed; call sites in dnsresolve / http / gowitness / portscan / event_from_json refactored to single-shot assignments via the new property setter. Lets the inheritance path trust parent.resolved_hosts without any defensive snapshot.

Benchmark

bbot/test/benchmarks/test_intercept_throughput_benchmarks.py::TestInterceptCloudcheckDNSThroughput — 1000 synthetic DNS_NAME events with 3 resolved IPs each, injected into the intercept chain.

Variant	Baseline	This PR	Δ
quiet	1485 events/sec	1932	+30%
loaded (20 busy tasks)	1336	1853	+39%
inherited (parent already cloudchecked)	1485	2241	+51%

The inherited variant covers the common path in real scans where children walk through the intercept chain after their parent has already been tagged (URL → HTTP_RESPONSE → FINDING, DNS_NAME → IP_ADDRESS, etc.).

Notes

• Bumping _module_threads was tested and rejected: cloudcheck.lookup is single-threaded CPU work dispatched through asyncio (the Rust binding returns a Future but the work is sync), so more coroutine workers do not unlock parallelism. asyncio.gather of 2000 lookups is slightly slower than sequential.
• Filed upstream cloudcheck#264 asking for structured pattern metadata so the YARA prefilter would not need to string-replace (?P<name> to translate Python regex flavor.
• The _eventloop_profiler.py script is a diagnostic utility (not a pytest test). Underscore-prefixed so pytest does not collect it; run directly: python bbot/test/benchmarks/_eventloop_profiler.py <bbot args>.

[github-actions]

🚀 Performance Benchmark Report

⚠️ No current benchmark data available

This might be because:

• Benchmarks failed to run
• No benchmark tests found
• Dependencies missing

[codecov]

Codecov Report

❌ Patch coverage is 36.34538% with 317 lines in your changes missing coverage. Please review.
✅ Project coverage is 90%. Comparing base (cc7b892) to head (826406a).
⚠️ Report is 67 commits behind head on dev.

Files with missing lines	Patch %	Lines
bbot/test/benchmarks/_eventloop_profiler.py	0%	239 Missing ⚠️
...benchmarks/test_intercept_throughput_benchmarks.py	15%	64 Missing ⚠️
bbot/modules/internal/cloudcheck.py	89%	12 Missing ⚠️
bbot/core/event/base.py	78%	2 Missing ⚠️

Additional details and impacted files

@@          Coverage Diff           @@
##             dev   #3129    +/-   ##
======================================
- Coverage     91%     90%    -0%     
======================================
  Files        448     449     +1     
  Lines      42631   43164   +533     
======================================
+ Hits       38380   38594   +214     
- Misses      4251    4570   +319     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.