luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Persist dry-run response plans

Browse source
This commit is contained in:
Luna 2026-06-13 05:53:48 -07:00
parent 812cf0c836
commit 1a5b6f1d8d
11 changed files with 133 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

4
CLAUDE.md
View file

@ -51,7 +51,9 @@ Start with:
- `events/` contains optional eBPF exec/syscall monitoring and declarative rules.
- `snapshot.py` writes forensic `.log` and `.json` evidence.
- `incident.py` groups snapshots by process lineage and time window.
- `respond.py` builds read-only response plans from incident evidence.
- `respond.py` builds read-only response plans from incident evidence; the CLI
persists reviewed dry-run plans under `response-plans/` and appends
`response-audit.log`, while dashboard/API previews stay write-free.
- `web.py` serves the HTTPS-only management console and JSON APIs.
- `rootcheck.py` performs anti-rootkit cross-view checks:
hidden processes, processes hidden from `ps`, hidden modules, hidden