luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Expand TUI and package recovery planning

Browse source
This commit is contained in:
Luna 2026-07-09 05:51:59 -07:00
parent cab60cd633
commit 51d52b5229
No known key found for this signature in database
10 changed files with 511 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

25
docs/COMMAND_REFERENCE.md
View file

@ -324,11 +324,14 @@ enodia-sentinel respond plan <incident-id> --json
Builds a dry-run response plan from an incident's retained JSON snapshots. The
plan may include evidence preservation, process freeze/terminate candidates,
outbound IP blocks, systemd unit disablement, suspicious-file quarantine,
package-restore lookup, and follow-up verification checks. Recovery checks stay
read-only too: plans can ask the operator to re-run `fim-check --packages`,
verify package files with `pkgdb-verify`, re-run `rootcheck`, confirm
persistence alerts are gone with `check --json`, and run `watchdog` from another
host to prove the heartbeat/dashboard path is visible.
package-restore planning, and follow-up verification checks. Package restore
guidance stays explicit: identify the owner with `pacman -Qo`, verify signed
package-cache metadata with `pkgdb-verify`, reinstall the owner from trusted
package media, then re-run `fim-check --packages` and `fim-update` only after
operator review. Recovery checks stay read-only too: plans can ask the operator
to re-run `rootcheck`, confirm persistence alerts are gone with `check --json`,
and run `watchdog` from another host to prove the heartbeat/dashboard path is
visible.
This command is intentionally read-only: it prints commands for operator review
and never executes them. Each CLI-generated plan is also saved under
@ -374,11 +377,14 @@ enodia-sentinel-tui
Opens the stdlib curses terminal dashboard for SSH/tmux operators. It does not
require the optional tray dependencies and reads the same local state as the CLI:
daemon status, recent alert snapshots, incident index, and event-rule metadata.
daemon status, recent alert snapshots, incident index and timelines, posture
findings, integrity/watchdog state, event-rule metadata, event tail, and
read-only response-plan previews.
Keys:
- `1` / `2` / `3` / `4`: status, alerts, incidents, rules.
- `1` / `2` / `3` / `4`: status, alerts, incidents, timelines.
- `5` / `6` / `7` / `8` / `9`: posture, integrity, rules, events, response plans.
- `j` / `k` or arrows: scroll.
- `r`: refresh.
- `/`: filter the current view.
@ -387,8 +393,9 @@ Keys:
- `Ctrl-L`: redraw.
- `q`: quit.
Command mode supports `status`, `alerts`, `incidents`, `rules`, `help`,
`refresh`, `filter <text>`, `clear`, and `quit`.
Command mode supports `status`, `alerts`, `incidents`, `timeline`, `posture`,
`integrity`, `rules`, `events`, `response`, `help`, `refresh`,
`filter <text>`, `clear`, and `quit`.
### `web`