luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add enrichment and SID coverage gates

Browse source
This commit is contained in:
Luna 2026-07-08 17:05:17 -07:00
parent 93ac47dd82
commit 66472134d8
32 changed files with 1623 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

18
README.md
View file

@ -324,7 +324,13 @@ sudo systemctl enable --now enodia-sentinel-web
CLI-generated response plans are saved for handoff/review under
`<log_dir>/response-plans/`, with a JSONL trail in
`<log_dir>/response-audit.log`. Dashboard plan previews stay read-only and do
not create artifacts.
not create artifacts. Plans also include read-only recovery checks for package
verification, rootcheck, persistence re-checks, and off-host watchdog visibility.
Alert snapshots include a best-effort enrichment block that annotates flagged
processes and paths with package ownership, executable hashes, parent chains,
remote IP classification, file metadata, recent watched writes, and local
integrity/rootcheck anchor status.
## Phone push notifications
@ -506,14 +512,18 @@ enodia-sentinel triage # classify captured alerts, suggest allowlist entries
[FP ] new_listener x1 loopback-only listener (not externally reachable)
[REVIEW] new_listener x1 unrecognized listener *:1740 (?)
...
To suppress the false positives, add to your config:
# listener_allow_comms += "qbittorrent"
Suggested TOML after review (Sentinel does not edit config):
# Triage suggestion for sid=100013 classtype=backdoor-listener.
# Add only after verifying this 'qbittorrent' activity is expected: package-owned listener.
listener_allow_comms = ["qbittorrent"]
```
Triage is deliberately conservative: `reverse_shell`, `egress`, and the eBPF
exec rules are **always** flagged review (provenance can't clear a network
shell), and any listener it *can't* attribute to a process is reviewed rather
than cleared. Suppression is never automatic — you choose what to allowlist.
than cleared. Suppression is never automatic — you choose what to allowlist. When
triage can suggest tuning, it emits copyable TOML with the alert `sid` and
`classtype` in comments so the reason stays auditable.
Knobs to quiet known-good activity: