luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(go): persist Python-compatible incidents

Browse source
This commit is contained in:
Luna 2026-07-22 01:59:49 -07:00
parent f85c2e831a
commit 538d1d954a
No known key found for this signature in database
13 changed files with 555 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

9
docs/SURICATA_ASSIMILATION.md
View file

@ -249,10 +249,11 @@ signature keeps `sid` / `signature` / `classtype` / tests / docs.
isolated baseline state, journal JSONL, a bounded retained JSONL stream, and
an atomic health marker. All current typed-host families now have native
transports. Bounded `enodia.alert.snapshot.v1` JSON/text pairs now retain
alerts with basic process context and feed truthful status counts. Incident
grouping, rich enrichment/assurance, management-consumer integration, and
broader parity must land before the bcc/Python runtime dependency can be
dropped.
alerts with basic process context and feed truthful status counts. An atomic
`enodia.incident.v1` index supplies lineage/time grouping, snapshot IDs, and
correlation evidence. Rich enrichment/assurance, management-consumer
integration, and broader parity must land before the bcc/Python runtime
dependency can be dropped.
- **Phase 3 — Rule-engine parity + assimilation.** `rev`/`reference`/`metadata`,
statebits (flowbits), thresholding, suppression, and — if rule count warrants
— the MPM prefilter. `rules list/show/test/docs` parity.