luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add typed host event egress rule

Browse source
This commit is contained in:
Luna 2026-07-09 06:04:30 -07:00
parent 0b010df514
commit 3b037646d2
15 changed files with 360 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

10
README.md
View file

@ -26,7 +26,7 @@ behind reviewed response workflows rather than silent remediation.
| Function | Current capability | Direction |
|---|---|---|
| Detect | Poll detectors + eBPF exec/syscall rules | More event sources and correlation |
| Detect | Poll detectors + eBPF exec/syscall rules + typed host-event fixtures | More live event sources and correlation |
| Prevent | Posture checks + dry-run containment plans | Audited, explicit `--apply` workflows |
| Verify | FIM, package DB anchor, signed-package checks | External anchors and signed evidence |
| Investigate | Text/JSON snapshots, incidents, dashboard, triage | Richer timelines and evidence export |
@ -103,9 +103,11 @@ spawning a shell — webshell/RCE (`100003`), and `curl|sh`-style ingress tool
transfer (`100004`). The syscall stream adds short-lived memory/anti-analysis
coverage for RWX `mprotect`/`mmap` (`100060`/`100061`), `memfd_create`
(`100062`), sensitive `ptrace` (`100063`), seccomp hardening (`100064`),
cross-process memory access (`100065`), and memory locking (`100066`).
Operators add custom exec rules via `exec_rules_file` without touching code.
They can inspect and test the active event rule set with:
cross-process memory access (`100065`), and memory locking (`100066`). Typed
host-event fixtures now cover `tcp_connect`, starting with interpreter egress
to unusual public ports (`100067`) while live network event capture remains a
v1.1 roadmap item. Operators add custom exec rules via `exec_rules_file`
without touching code. They can inspect and test the active event rule set with:
```bash
enodia-sentinel rules list