Persist dry-run response plans

This commit is contained in:
Luna 2026-06-13 05:53:48 -07:00
parent 812cf0c836
commit 1a5b6f1d8d
11 changed files with 133 additions and 5 deletions

View file

@ -274,6 +274,11 @@ sudo systemctl enable --now enodia-sentinel-web
API at `/api/status`, `/api/incidents`, `/api/respond/plan/<id>`,
`/api/posture`, `/api/alerts`, `/api/alerts/<id>`, `/api/events`.
CLI-generated response plans are saved for handoff/review under
`<log_dir>/response-plans/`, with a JSONL trail in
`<log_dir>/response-audit.log`. Dashboard plan previews stay read-only and do
not create artifacts.
## Phone push notifications
When an alert at/above `notify_min_severity` fires, Sentinel pushes to whichever