luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add typed host event egress rule

Browse source
This commit is contained in:
Luna 2026-07-09 06:04:30 -07:00
parent 0b010df514
commit 3b037646d2
15 changed files with 360 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/SPECIFICATION.md
View file

@ -70,7 +70,9 @@ Optional bcc eBPF monitors feed event rule engines. The `execve` stream closes
the polling gap for short-lived commands and supports custom TOML rules without
code changes. The syscall stream watches short-lived memory and anti-analysis
behavior: RWX `mprotect`/`mmap`, `memfd_create`, sensitive `ptrace`, seccomp,
cross-process memory access, and memory locking. Failure is fail-safe: if a
cross-process memory access, and memory locking. Typed host-event rules can be
tested from JSON fixtures before live sources exist; `tcp_connect` currently
covers interpreter egress to unusual public ports. Failure is fail-safe: if a
probe cannot load, polling continues.
### Integrity and Tamper-Evidence
@ -136,8 +138,8 @@ incident.
### Detect
- More event sources: `tcp_connect`, `bind`, `accept`, file-write events for
persistence paths, module loading, privilege transitions, and LSM hooks.
- More live event sources: `tcp_connect`, `bind`, `accept`, file-write events
for persistence paths, module loading, privilege transitions, and LSM hooks.
- Correlation across signals: "web service spawned shell" + "new listener" +
"persistence write" should become one incident, not three unrelated alerts.
- Optional YARA-style and Sigma-like local rules if they can stay dependency