luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Document current Sentinel project state

Browse source
This commit is contained in:
Luna 2026-06-13 06:46:33 -07:00
parent 6a09fbb7f9
commit 1f05923e0f
4 changed files with 73 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/ROADMAP.md
View file

@ -64,9 +64,11 @@ Purpose: move from "tell me" to "help me act" without unsafe automation.
`enodia-sentinel respond plan <incident-id>`.
- ✅ Persist CLI-generated dry-run plans under `response-plans/` and append
`response-audit.log` records for review/handoff.
- Add dry-run first actions:
kill process, stop/disable service, block remote IP, quarantine file, restore
package-owned file by reinstalling its package, and freeze evidence.
- ✅ Add dry-run first actions for evidence freeze, process freeze/terminate,
outbound IP block, systemd stop/disable, suspicious-file quarantine,
package-owner lookup, and follow-up verification.
- Add package reinstall/restore planning after trusted-media and package-manager
semantics are designed for pacman, dpkg, and rpm.
- Require explicit `--apply` for changes; default to read-only plans.
- Extend response audit logs to any future state-changing `--apply` workflow.
- Add baseline reconciliation:

13
docs/SPECIFICATION.md
View file

@ -43,7 +43,7 @@ The long-term product should combine six functions:
6. **Bash prototype remains the oracle.** The original shell implementation and
red-team harness preserve behavioral compatibility for core signatures.
## Current Scope: v0.8-dev
## Current Scope: Local IDS/IPS/EDR
### Poll Detectors
@ -100,9 +100,9 @@ When a fresh alert survives cooldown, Sentinel writes:
| Interface | Role |
|---|---|
| CLI | Run daemon, one-shot checks, baseline management, FIM checks, package DB checks, rootcheck, posture audit, incident review, triage, watchdog. |
| CLI | Run daemon, one-shot checks, baseline management, FIM checks, package DB checks, rootcheck, posture audit, incident review/export, triage, status/watchdog, and response planning. |
| Logs | Durable local evidence under `/var/log/enodia-sentinel`. |
| Dashboard | Read-only web view for status, alert browsing, and snapshot inspection. |
| Dashboard | HTTPS-only read-only web view for status, incidents, timelines, alert browsing, posture findings, event tail, and response-plan previews. |
| Push | ntfy, Pushover, and generic webhook notifications. |
| Red-team harness | Safe drills for testing signatures and demos. |
@ -111,6 +111,13 @@ reviewed dry-run plan under `response-plans/` and appends a JSONL
`response-audit.log` record. Dashboard/API previews remain read-only and do not
create artifacts.
Current IPS scope is explicit prevention workflow, not transparent inline
enforcement. Sentinel can recommend evidence preservation, process
freeze/termination, outbound IP blocks, systemd unit disablement, suspicious-file
quarantine, package-owner lookup, and follow-up verification. It does not
execute those commands until a future audited `--apply` workflow is designed,
tested, and documented.
## Target Scope: Host Security Platform
The next product shape should make Enodia useful before, during, and after an