Expand rootkit monitoring and Claude docs

docs/ROADMAP.md

@@ -95,6 +95,13 @@ Exit criteria:
 
 Purpose: reduce blind spots and connect related signals.
 
+- Generalize the exec-rule engine into a typed host-event rule engine:
+  `exec`, `tcp_connect`, `bind`, `listen`, `accept`, `file_write`,
+  `chmod/chown`, `setuid/setgid`, `capset`, and module-load events.
+- Keep rules declarative and Snort-like:
+  `sid`, `msg`, `severity`, `classtype`, `event`, and match fields such as
+  process name, parent process, argv regex, path prefix, peer IP/port, UID/GID,
+  package ownership, and lineage.
 - Add eBPF event sources:
   `tcp_connect`, `bind`, `accept`, module load, privilege transitions, and
   writes to watched persistence paths.
@@ -102,13 +109,60 @@ Purpose: reduce blind spots and connect related signals.
 - Correlate multi-stage behavior:
   web service spawns shell, shell downloads payload, payload adds persistence,
   listener appears, and FIM changes.
-- Add configurable correlation windows and severity escalation rules.
+- Add configurable correlation windows and severity escalation rules, including:
+  - `exec_rule.web-rce` + suspicious egress + persistence within 10 minutes →
+    CRITICAL multi-stage intrusion.
+  - `new_listener` + `new_suid` in the same lineage/window → CRITICAL backdoor
+    with privilege-escalation artifact.
+  - `fim_modified` or `pkg_signature_mismatch` + `pkgdb_tamper` → CRITICAL
+    suspected trojaned binary with checksum cover-up.
+  - web/database service spawning shell + tool transfer (`curl|wget|sh`) →
+    CRITICAL likely RCE payload staging.
+- Add high-signal living-off-the-land detections:
+  `curl|wget | sh`, Python/perl/bash reverse-shell argv variants,
+  `systemctl enable` from unusual ancestry, `chmod +s` outside package
+  transactions, interpreter egress to unusual public ports, and execution from
+  writable directories.
+- Add first-seen and rarity tracking for local network behavior:
+  first public destination per process name, first listening port per binary,
+  interpreter connections to non-standard ports, and long-lived low-byte
+  connections when socket sampling can support it.
 - Keep polling as the oracle and fallback.
 
 Exit criteria:
 
 - Short-lived network and persistence actions are visible.
 - Related alerts collapse into one incident with a readable timeline.
+- Multi-stage correlation raises one higher-confidence incident without hiding
+  the underlying raw alerts.
+
+## v1.1.1: IDS Quality and Rule Operations
+
+Purpose: make detection coverage easier to audit, tune, and extend without
+turning Sentinel into a noisy rules dump.
+
+- Add `enodia-sentinel rules list` and `rules show <sid>` for built-in and
+  configured rules.
+- Add `enodia-sentinel rules test <event-json>` so operators can validate custom
+  event rules against captured or fixture events.
+- Generate rule documentation from source defaults: SID, signature, classtype,
+  event type, match fields, expected false positives, and drill coverage.
+- Require a fixture or safe red-team drill for every built-in SID, including
+  event-only and correlation SIDs.
+- Add compatibility tests for rule JSON/event schema evolution.
+- Extend triage so false-positive suggestions are tied to SID/classtype and can
+  emit TOML snippets for allowlists, correlation windows, or severity overrides.
+- Add post-alert enrichment consistently across detections:
+  package owner, executable hash, parent/ancestor chain, remote IP
+  classification, file mode/owner, recent writes by same lineage, and current
+  FIM/package/rootcheck status.
+
+Exit criteria:
+
+- Operators can inspect, test, document, and tune detection rules without
+  reading Python source.
+- Every shipped IDS rule has reproducible fixture/drill coverage and stable
+  operator documentation.
 
 ## v1.2: Fleet Mode