luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add typed host event egress rule

Browse source
This commit is contained in:
Luna 2026-07-09 06:04:30 -07:00
parent 0b010df514
commit 3b037646d2
15 changed files with 360 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

3
enodia_sentinel/sids.py
View file

@ -17,6 +17,7 @@ from .detectors import (
stealth_network,
)
from .events.rules import DEFAULT_EXEC_RULES
from .events.host_rules import DEFAULT_HOST_RULES
from .events.syscall_rules import DEFAULT_SYSCALL_RULES
@ -42,6 +43,8 @@ BUILTIN_SIDS: tuple[SidInfo, ...] = (
"enodia_sentinel.events.rules"),
*_rule_rows(DEFAULT_SYSCALL_RULES, "syscall_rule",
"enodia_sentinel.events.syscall_rules"),
*_rule_rows(DEFAULT_HOST_RULES, "host_rule",
"enodia_sentinel.events.host_rules"),
SidInfo(100010, "reverse_shell", "detector", f"{_DETECTORS}.reverse_shell"),
SidInfo(100011, "ld_preload", "detector", f"{_DETECTORS}.ld_preload"),
SidInfo(100012, "deleted_exe", "detector", f"{_DETECTORS}.deleted_exe"),