luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add event rule inspection commands

Browse source
This commit is contained in:
Luna 2026-06-15 05:36:58 -07:00
parent 1f05923e0f
commit 5db88d285e
7 changed files with 417 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

9
README.md
View file

@ -97,6 +97,13 @@ coverage for RWX `mprotect`/`mmap` (`100060`/`100061`), `memfd_create`
(`100062`), sensitive `ptrace` (`100063`), seccomp hardening (`100064`),
cross-process memory access (`100065`), and memory locking (`100066`).
Operators add custom exec rules via `exec_rules_file` without touching code.
They can inspect and test the active event rule set with:
```bash
enodia-sentinel rules list
enodia-sentinel rules show 100002
enodia-sentinel rules test event.json
```
The layer is **fail-safe**: if `bcc`/root/BTF aren't available it logs the
reason and the daemon runs poll-only — a broken probe can never take detection
@ -107,7 +114,7 @@ framing (and the queued FIM / hidden-process checks) from **OSSEC**.
```
enodia_sentinel/
├── cli.py run / check / baseline / list-detectors
├── cli.py run / check / baseline / rules / list-detectors
├── daemon.py sweep loop · cooldown dedup · backgrounded SUID scan
├── system.py SystemState — one cached snapshot of /proc + ss per sweep
├── snapshot.py forensic text+JSON capture · response guidance · retention