luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Document current Sentinel project state

Browse source
This commit is contained in:
Luna 2026-06-13 06:46:33 -07:00
parent 6a09fbb7f9
commit 1f05923e0f
4 changed files with 73 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/ROADMAP.md
View file

@ -64,9 +64,11 @@ Purpose: move from "tell me" to "help me act" without unsafe automation.
`enodia-sentinel respond plan <incident-id>`.
- ✅ Persist CLI-generated dry-run plans under `response-plans/` and append
`response-audit.log` records for review/handoff.
- Add dry-run first actions:
kill process, stop/disable service, block remote IP, quarantine file, restore
package-owned file by reinstalling its package, and freeze evidence.
- ✅ Add dry-run first actions for evidence freeze, process freeze/terminate,
outbound IP block, systemd stop/disable, suspicious-file quarantine,
package-owner lookup, and follow-up verification.
- Add package reinstall/restore planning after trusted-media and package-manager
semantics are designed for pacman, dpkg, and rpm.
- Require explicit `--apply` for changes; default to read-only plans.
- Extend response audit logs to any future state-changing `--apply` workflow.
- Add baseline reconciliation: