luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Expand TUI and package recovery planning

Browse source
This commit is contained in:
Luna 2026-07-09 05:51:59 -07:00
parent cab60cd633
commit 51d52b5229
No known key found for this signature in database
10 changed files with 511 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

15
docs/OPERATIONS.md
View file

@ -78,8 +78,10 @@ summarizes FIM/package anchors plus heartbeat freshness under the Integrity tab
for quick remote review.
For SSH/tmux operators, `enodia-sentinel tui` provides a terminal dashboard over
the same local state: status, recent alerts, incidents, and rules. Use `:` for
command mode and `Tab` to complete TUI commands.
the same local read-only management state: status, recent alerts, incidents,
incident timelines, posture findings, integrity/watchdog state, event-rule
metadata, event tail, and dry-run response-plan previews. Use `:` for command
mode and `Tab` to complete TUI commands.
On desktop hosts the optional tray applet (`enodia-sentinel-tray`, `[tray]`
extra) wraps the same workflow: it drives the same `systemctl` units operators
@ -107,11 +109,16 @@ When Sentinel fires:
commands. CLI-generated plans are saved under
`/var/log/enodia-sentinel/response-plans/` and indexed in
`/var/log/enodia-sentinel/response-audit.log` for later review.
5. If the alert involves a binary, run:
5. If the alert involves a package-owned binary, review the package recovery
actions in the response plan and run the restore sequence only after the
owning package and package source are trusted:
```bash
enodia-sentinel fim-check --packages
pacman -Qo /path/to/file
enodia-sentinel pkgdb-verify --sample 200
pacman -S --overwrite '*' <package>
enodia-sentinel fim-check --packages
enodia-sentinel fim-update
```
6. If the alert involves hiding or tampering, run: