luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add enrichment and SID coverage gates

Browse source
This commit is contained in:
Luna 2026-07-08 17:05:17 -07:00
parent 93ac47dd82
commit 66472134d8
32 changed files with 1623 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

39
enodia_sentinel/respond.py
View file

@ -172,6 +172,15 @@ def build_plan(bundle: dict, cfg: Config) -> dict:
reason="Confirm package-owned and FIM-monitored files match expected state.",
risk="low",
))
if {"fim_pkg_modified", "pkg_signature_mismatch", "pkgdb_tamper"} & sigs:
add(ResponseAction(
id="",
category="verification",
title="Verify package-owned files against signed cache packages",
command=("enodia-sentinel", "pkgdb-verify"),
reason="Check on-disk package files against signed package metadata instead of the mutable local DB.",
risk="low",
))
if any(s.startswith("rootkit_") or s in {"new_listener", "promiscuous_interface"}
for s in sigs):
add(ResponseAction(
@ -182,6 +191,27 @@ def build_plan(bundle: dict, cfg: Config) -> dict:
reason="Confirm cross-view hidden process/module/port findings are gone.",
risk="low",
))
if {"persistence", "new_suid", "fim_added", "fim_modified", "fim_removed"} & sigs:
add(ResponseAction(
id="",
category="verification",
title="Confirm no persistence diff remains",
command=("enodia-sentinel", "check", "--json"),
reason="Re-run the detector set after containment to confirm persistence-related alerts are gone.",
risk="low",
))
watchdog_url = _watchdog_url(cfg)
add(ResponseAction(
id="",
category="verification",
title="Confirm heartbeat and dashboard visibility",
command=("enodia-sentinel", "watchdog", "--url", watchdog_url,
"--token", "<token>", "--insecure-tls"),
reason="Run from another host or tailnet peer to prove the sensor heartbeat and HTTPS dashboard are reachable.",
risk="low",
targets={"url": watchdog_url},
))
numbered = []
for i, action in enumerate(actions, 1):
@ -336,3 +366,12 @@ def _is_quarantine_candidate(path: str, sig: str) -> bool:
if path == "/etc/ld.so.preload":
return False
return False
def _watchdog_url(cfg: Config) -> str:
if cfg.dashboard_url:
return cfg.dashboard_url.rstrip("/")
host = cfg.web_bind or "<dashboard-host>"
if ":" in host and not host.startswith("[") and host != "<dashboard-host>":
host = f"[{host}]"
return f"https://{host}:{cfg.web_port}"