luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Document current Sentinel project state

Browse source
This commit is contained in:
Luna 2026-06-13 06:46:33 -07:00
parent 6a09fbb7f9
commit 1f05923e0f
4 changed files with 73 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

14
README.md
View file

@ -26,11 +26,11 @@ behind reviewed response workflows rather than silent remediation.
| Function | Current capability | Direction |
|---|---|---|
| Detect | Poll detectors + eBPF exec rules | More event sources and correlation |
| Detect | Poll detectors + eBPF exec/syscall rules | More event sources and correlation |
| Prevent | Posture checks + dry-run containment plans | Audited, explicit `--apply` workflows |
| Verify | FIM, package DB anchor, signed-package checks | External anchors and signed evidence |
| Investigate | Text/JSON snapshots, dashboard, triage | Incident timelines and evidence export |
| Respond | Human guidance today | Dry-run response plans and audited containment |
| Investigate | Text/JSON snapshots, incidents, dashboard, triage | Richer timelines and evidence export |
| Respond | Persisted dry-run response plans | Audited containment and recovery execution |
| Assure | Heartbeat, watchdog, self-integrity, rootcheck | Fleet health and attestation-ready anchors |
Project docs:
@ -127,16 +127,22 @@ enodia_sentinel/
├── notify/ outbound push — ntfy / Pushover / webhook backends
└── events/ event-driven layer (eBPF)
├── bcc_source.py real eBPF execve probe loaded via bcc
├── bcc_syscall_source.py real eBPF syscall telemetry probe
├── exec_event.py the ExecEvent type
├── syscall_event.py the SyscallEvent type
├── rules.py Snort-style ExecRule engine + default rules
├── syscall_rules.py memory/anti-analysis SyscallRule engine
└── monitor.py runs the probe on a thread, routes events → rules
```
Two complementary detection paths feed one Alert → snapshot pipeline:
Three complementary detection paths feed one Alert → snapshot pipeline:
- **Poll** — every few seconds, sweep `/proc`/`ss` (catches anything lingering).
- **Event** — eBPF fires on every `execve`, matched against the rule engine
(catches processes that exit *between* sweeps).
- **Syscall event** — optional eBPF telemetry catches short-lived memory and
anti-analysis actions such as RWX mappings, `memfd_create`, `ptrace`,
seccomp, cross-process memory access, and memory locking.
The loop is deliberately the same control flow as the bash prototype, but the
state lives in real objects: