luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add egress drill + sid-verified harness and IR runbooks (roadmap v0.8)

Browse source 
Red-team harness: every detector now has a named drill with an expected
signature/sid, shown by `sentinel-redteam --list`. Add the missing
`egress` drill (the one detector without one) — explicit-only, since it
is the sole drill that emits real outbound traffic. After firing, the
harness runs `enodia-sentinel check` and reports PASS/MISS per poll
detection, turning it into a shared regression check.

Add docs/RUNBOOKS.md: confirm/preserve/contain/recover playbooks for
reverse shells & egress, persistence, trojaned binaries / package
tampering, hidden listeners & rootkits, and sensor tampering — each tied
to the real signatures, sids, and commands. Linked from README and the
OPERATIONS alert workflow.

Both close the remaining smaller v0.8 roadmap items.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Luna 2026-06-10 05:28:53 -07:00
parent f2d896a2d7
commit 4015ec872b
5 changed files with 335 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

3
docs/OPERATIONS.md
View file

@ -96,7 +96,8 @@ When Sentinel fires:
cp -a /var/log/enodia-sentinel /tmp/enodia-sentinel-evidence
```
7. Contain manually for now. Future response commands should produce a dry-run
7. Contain manually for now, following the matching playbook in
[RUNBOOKS.md](RUNBOOKS.md). Future response commands should produce a dry-run
plan first.
## Common Findings