Persist dry-run response plans
This commit is contained in:
parent
812cf0c836
commit
1a5b6f1d8d
11 changed files with 133 additions and 5 deletions
|
|
@ -274,6 +274,11 @@ sudo systemctl enable --now enodia-sentinel-web
|
|||
API at `/api/status`, `/api/incidents`, `/api/respond/plan/<id>`,
|
||||
`/api/posture`, `/api/alerts`, `/api/alerts/<id>`, `/api/events`.
|
||||
|
||||
CLI-generated response plans are saved for handoff/review under
|
||||
`<log_dir>/response-plans/`, with a JSONL trail in
|
||||
`<log_dir>/response-audit.log`. Dashboard plan previews stay read-only and do
|
||||
not create artifacts.
|
||||
|
||||
## Phone push notifications
|
||||
|
||||
When an alert at/above `notify_min_severity` fires, Sentinel pushes to whichever
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue