luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add event rule inspection commands

Browse source
This commit is contained in:
Luna 2026-06-15 05:36:58 -07:00
parent 1f05923e0f
commit 5db88d285e
7 changed files with 417 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

6
docs/ROADMAP.md
View file

@ -156,10 +156,10 @@ Exit criteria:
Purpose: make detection coverage easier to audit, tune, and extend without
turning Sentinel into a noisy rules dump.
- Add `enodia-sentinel rules list` and `rules show <sid>` for built-in and
- ✅ Add `enodia-sentinel rules list` and `rules show <sid>` for built-in and
configured rules.
- Add `enodia-sentinel rules test <event-json>` so operators can validate custom
event rules against captured or fixture events.
- ✅ Add `enodia-sentinel rules test <event-json>` so operators can validate
custom event rules against captured or fixture events.
- Generate rule documentation from source defaults: SID, signature, classtype,
event type, match fields, expected false positives, and drill coverage.
- Require a fixture or safe red-team drill for every built-in SID, including