Expand rootkit monitoring and Claude docs

enodia_sentinel/web.py

@@ -252,6 +252,23 @@ def response_plan(cfg: Config, incident_id: str) -> dict | None:
     return respond.build_plan(bundle, cfg)
 
 
+def posture_report(cfg: Config, runner=None) -> dict:
+    """Return advisory host posture findings for the management console."""
+    if runner is None:
+        from . import posture
+        runner = posture.run
+    findings = sorted(runner(cfg), key=lambda a: (-a.severity, a.signature))
+    counts: dict[str, int] = {}
+    for f in findings:
+        sev = str(f.severity)
+        counts[sev] = counts.get(sev, 0) + 1
+    return {
+        "count": len(findings),
+        "counts": counts,
+        "findings": [f.to_dict() for f in findings],
+    }
+
+
 # --- HTTP layer ------------------------------------------------------------
 
 class _Handler(BaseHTTPRequestHandler):
@@ -299,6 +316,8 @@ class _Handler(BaseHTTPRequestHandler):
                        200 if alert else 404)
         elif path == "/api/events":
             self._json({"events": tail_events(cfg)})
+        elif path == "/api/posture":
+            self._json(posture_report(cfg))
         elif path == "/api/incidents":
             self._json(list_incidents(cfg))
         elif path.startswith("/api/incidents/"):