luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add enrichment and SID coverage gates

Browse source
This commit is contained in:
Luna 2026-07-08 17:05:17 -07:00
parent 93ac47dd82
commit 66472134d8
32 changed files with 1623 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

32
tests/test_respond.py
View file

@ -70,11 +70,43 @@ class TestRespondPlan(unittest.TestCase):
self.assertIn(["systemctl", "disable", "--now", "bad.service"], commands)
self.assertIn(["mv", "--", "/tmp/suidsh",
"/tmp/suidsh.enodia-quarantine"], commands)
self.assertIn(["enodia-sentinel", "check", "--json"], commands)
self.assertIn(["enodia-sentinel", "watchdog", "--url",
"https://<dashboard-host>:8787", "--token", "<token>",
"--insecure-tls"], commands)
self.assertNotIn(["mv", "--", "/etc/systemd/system/bad.service",
"/etc/systemd/system/bad.service.enodia-quarantine"],
commands)
self.assertEqual(plan["actions"][0]["category"], "evidence")
def test_package_recovery_adds_signed_package_verify(self):
iid = incident.record(self.cfg, "alert-2.log", [
_alert("pkg_signature_mismatch",
"signed package mismatch /usr/bin/ssh",
sid=100022, sev=Severity.CRITICAL),
], lineage=set(), when=1001.0, host="h")
(self.tmp / "alert-2.json").write_text(json.dumps({
"time": "2026-06-10T10:01:00-07:00",
"host": "h",
"severity": "CRITICAL",
"incident_id": iid,
"alerts": [
{"signature": "pkg_signature_mismatch", "sid": 100022,
"detail": "signed package mismatch /usr/bin/ssh",
"pids": []},
],
"processes": [],
}))
self.cfg.dashboard_url = "https://100.64.0.2:8787/"
plan = respond.build_plan(respond.load_bundle(self.cfg, iid), self.cfg)
commands = [a["command"] for a in plan["actions"]]
self.assertIn(["enodia-sentinel", "fim-check", "--packages"], commands)
self.assertIn(["enodia-sentinel", "pkgdb-verify"], commands)
self.assertIn(["pacman", "-Qo", "/usr/bin/ssh"], commands)
self.assertIn(["enodia-sentinel", "watchdog", "--url",
"https://100.64.0.2:8787", "--token", "<token>",
"--insecure-tls"], commands)
def test_cli_json(self):
os.environ["ENODIA_LOG_DIR"] = str(self.tmp)
try: