From 6a09fbb7f9f2a9d3fdaf110d53783b73e99b8a4b Mon Sep 17 00:00:00 2001 From: Luna Date: Sat, 13 Jun 2026 05:59:03 -0700 Subject: [PATCH] Frame Sentinel as IDS IPS and EDR --- CLAUDE.md | 9 ++++++--- README.md | 23 ++++++++++++++--------- docs/ROADMAP.md | 9 +++++---- docs/SPECIFICATION.md | 17 +++++++++-------- docs/THREAT_MODEL.md | 4 ++++ enodia_sentinel/__init__.py | 8 ++++---- enodia_sentinel/cli.py | 2 +- packaging/PKGBUILD | 2 +- pyproject.toml | 4 ++-- systemd/enodia-sentinel.service | 2 +- 10 files changed, 47 insertions(+), 33 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index 2cbc94f..a7d97c3 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -4,14 +4,17 @@ Guidance for Claude or Claude Code agents working on Enodia Sentinel. ## Project Shape -Enodia Sentinel is a zero-runtime-dependency Linux host security platform. The +Enodia Sentinel is a zero-runtime-dependency Linux IDS/IPS/EDR platform. The core agent is pure Python standard library and should stay that way unless a dependency has clear security/operator value that cannot reasonably be achieved -with stdlib. +with stdlib. Its IPS scope is explicit prevention workflow: posture hardening, +containment planning, and future reviewed `--apply` actions, not silent inline +network blocking or automatic host mutation. Primary functions: -- Detect: poll detectors plus optional eBPF exec rules. +- Detect: poll detectors plus optional eBPF exec/syscall rules. +- Prevent: posture findings plus reviewed containment/recovery plans. - Verify: FIM, package DB anchor, signed-package verification, rootcheck. - Investigate: text/JSON snapshots, incidents, HTTPS management console. - Respond: dry-run plans first; any state-changing action must be explicit, diff --git a/README.md b/README.md index 472cd9c..692211b 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,9 @@ # Enodia Sentinel -A Linux endpoint detection and response platform: intrusion detection, -file/package integrity, anti-rootkit cross-checks, tamper-evidence, forensic -snapshots, push alerts, response planning, and a read-only operator console. +A Linux IDS/IPS/EDR platform: intrusion detection, explicit prevention and +containment workflows, endpoint detection and response, file/package integrity, +anti-rootkit cross-checks, tamper-evidence, forensic snapshots, push alerts, and +a read-only operator console. The current daemon continuously runs detectors over live system state — processes, sockets, file descriptors, the SUID inventory, sensitive files, the @@ -17,12 +18,16 @@ the package database was tampered with, and what to do next."* ## Product direction -Enodia Sentinel is an endpoint detection and response system. IDS-style -signatures are one detection layer inside a broader host security platform: +Enodia Sentinel is an IDS, IPS, and EDR system. IDS-style signatures identify +suspicious host behavior, IPS workflows turn those findings into explicit +containment/prevention plans, and EDR features preserve evidence for triage, +investigation, and recovery. Automatic inline blocking is intentionally gated +behind reviewed response workflows rather than silent remediation. | Function | Current capability | Direction | |---|---|---| | Detect | Poll detectors + eBPF exec rules | More event sources and correlation | +| Prevent | Posture checks + dry-run containment plans | Audited, explicit `--apply` workflows | | Verify | FIM, package DB anchor, signed-package checks | External anchors and signed evidence | | Investigate | Text/JSON snapshots, dashboard, triage | Incident timelines and evidence export | | Respond | Human guidance today | Dry-run response plans and audited containment | @@ -510,10 +515,10 @@ conscious tradeoff documented in the file itself. ## Roadmap -The short version: Enodia grows from local endpoint detection and response into -a host security platform: incident grouping, posture checks, response planning, -richer eBPF telemetry, fleet health, external anchors, and eventually -attestation-ready assurance. +The short version: Enodia grows from a local IDS/IPS/EDR agent into a host +security platform: incident grouping, posture checks, response planning, richer +eBPF telemetry, fleet health, external anchors, and eventually attestation-ready +assurance. See [docs/ROADMAP.md](docs/ROADMAP.md) for the release tracks and phased plan. The polling daemon isn't throwaway — it's the **oracle**: every signature is a diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md index 51ba243..5760bc6 100644 --- a/docs/ROADMAP.md +++ b/docs/ROADMAP.md @@ -1,15 +1,16 @@ # Enodia Sentinel Roadmap -This roadmap moves Enodia Sentinel from single-host endpoint detection and -response into a fuller host security platform: detect, verify, investigate, -respond, and assure. Dates are intentionally not promised here; the sequence -matters more than calendar precision. +This roadmap moves Enodia Sentinel from a single-host IDS/IPS/EDR agent into a +fuller host security platform: detect, prevent, verify, investigate, respond, +and assure. Dates are intentionally not promised here; the sequence matters more +than calendar precision. ## Release Tracks | Track | Goal | |---|---| | Sensor | Better host telemetry, event capture, and detection coverage. | +| Prevention | Safe containment and recovery actions that start as dry-run plans and require explicit review before any state change. | | Integrity | Stronger proof that files, packages, baselines, and Sentinel itself were not silently modified. | | Incident | Group alerts, build timelines, and export evidence. | | Response | Add safe, auditable containment and recovery workflows. | diff --git a/docs/SPECIFICATION.md b/docs/SPECIFICATION.md index d24224d..51cb845 100644 --- a/docs/SPECIFICATION.md +++ b/docs/SPECIFICATION.md @@ -1,12 +1,12 @@ # Enodia Sentinel Specification -This document defines Enodia Sentinel as an endpoint detection and response -system, not only a signature IDS. The current implementation is a local Linux -sensor with evidence capture, integrity monitoring, anti-rootkit checks, a -dashboard, alert delivery, and dry-run response planning. The intended product -is a defensive control plane for a host or small fleet: detect compromise, prove -what changed, preserve useful evidence, guide response, and make sensor -tampering visible. +This document defines Enodia Sentinel as an IDS, IPS, and EDR system, not only a +signature IDS. The current implementation is a local Linux sensor with evidence +capture, integrity monitoring, anti-rootkit checks, a dashboard, alert delivery, +and dry-run prevention/response planning. The intended product is a defensive +control plane for a host or small fleet: detect compromise, prevent or contain +known-bad behavior through explicit operator workflows, prove what changed, +preserve useful evidence, guide response, and make sensor tampering visible. ## Product Definition @@ -15,11 +15,12 @@ as a local daemon, observes high-signal host behavior, records forensic context when something suspicious happens, and exposes the result through local files, JSON, a read-only dashboard, push notifications, and command-line tools. -The long-term product should combine five functions: +The long-term product should combine six functions: | Function | Purpose | |---|---| | Detection | Find active compromise behavior: reverse shells, fileless execution, new listeners, suspicious egress, persistence edits, and privilege-escalation artifacts. | +| Prevention | Recommend and, after explicit review, apply containment actions such as stopping malicious processes, blocking C2 peers, disabling persistence, or quarantining files. | | Integrity | Prove whether important files, packages, baselines, and Sentinel's own footprint changed. | | Evidence | Capture enough context for incident response without forcing the operator to reproduce a live state after the attacker is gone. | | Response | Provide safe, explicit operator workflows for triage, containment, and recovery. | diff --git a/docs/THREAT_MODEL.md b/docs/THREAT_MODEL.md index ea329b5..fa908ee 100644 --- a/docs/THREAT_MODEL.md +++ b/docs/THREAT_MODEL.md @@ -80,12 +80,16 @@ Sentinel assumes: - The dashboard is read-only by design; it can display dry-run response plans but does not execute containment commands. - The current product does not perform automatic containment. +- Sentinel's IPS scope is explicit prevention workflow: posture hardening, + containment planning, and future reviewed `--apply` actions. It is not an + inline network appliance and does not silently rewrite host state. ## Security Controls Already Present | Control | Purpose | |---|---| | Hardened systemd unit | Limits daemon write surface and runtime privilege where possible. | +| Explicit IPS workflow | Turns detections into reviewed prevention/containment plans without automatic remediation. | | Cooldown deduplication | Prevents alert storms from one persistent condition. | | Snapshot retention | Preserves evidence while bounding local disk growth. | | FIM self-watch | Detects changes to Sentinel's own files and service definitions. | diff --git a/enodia_sentinel/__init__.py b/enodia_sentinel/__init__.py index 7886812..695650a 100644 --- a/enodia_sentinel/__init__.py +++ b/enodia_sentinel/__init__.py @@ -1,9 +1,9 @@ # SPDX-License-Identifier: GPL-3.0-or-later -"""Enodia Sentinel — a Linux host security platform. +"""Enodia Sentinel — a Linux IDS/IPS/EDR platform. -Detection, file/package integrity, anti-rootkit checks, tamper-evidence, -forensic snapshots, and operator workflows. The Python re-architecture of the -bash v0 prototype. +Detection, explicit prevention workflows, file/package integrity, anti-rootkit +checks, tamper-evidence, forensic snapshots, and operator response. The Python +re-architecture of the bash v0 prototype. """ __version__ = "0.7.0" diff --git a/enodia_sentinel/cli.py b/enodia_sentinel/cli.py index 07f0c0b..cbd5f97 100644 --- a/enodia_sentinel/cli.py +++ b/enodia_sentinel/cli.py @@ -51,7 +51,7 @@ def _cmd_check(cfg: Config) -> int: def main(argv: list[str] | None = None) -> int: parser = argparse.ArgumentParser( prog="enodia-sentinel", - description="Linux host security platform.", + description="Linux IDS/IPS/EDR platform.", ) parser.add_argument("--version", action="version", version=f"enodia-sentinel {__version__}") diff --git a/packaging/PKGBUILD b/packaging/PKGBUILD index 6f902b3..525f421 100644 --- a/packaging/PKGBUILD +++ b/packaging/PKGBUILD @@ -2,7 +2,7 @@ pkgname=enodia-sentinel pkgver=0.6.0 pkgrel=1 -pkgdesc="Linux endpoint detection and response agent with IDS, integrity, anti-rootkit, and forensic response features" +pkgdesc="Linux IDS/IPS/EDR agent with integrity, anti-rootkit, forensic evidence, and explicit prevention workflows" arch=('any') url="https://github.com/Enodia/enodia-sentinel" license=('GPL-3.0-or-later') diff --git a/pyproject.toml b/pyproject.toml index 262c215..1c89d5f 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -5,12 +5,12 @@ build-backend = "setuptools.build_meta" [project] name = "enodia-sentinel" version = "0.7.0" -description = "Linux endpoint detection and response platform — detection, integrity, anti-rootkit checks, tamper-evidence, and forensic snapshots" +description = "Linux IDS/IPS/EDR platform — detection, explicit prevention workflows, integrity, anti-rootkit checks, and forensic snapshots" readme = "README.md" requires-python = ">=3.11" license = { text = "GPL-3.0-or-later" } authors = [{ name = "Enodia" }] -keywords = ["security", "edr", "ids", "hids", "detection", "linux", "forensics", "response"] +keywords = ["security", "edr", "ids", "ips", "hids", "detection", "prevention", "linux", "forensics", "response"] classifiers = [ "License :: OSI Approved :: GNU General Public License v3 or later (GPLv3+)", "Operating System :: POSIX :: Linux", diff --git a/systemd/enodia-sentinel.service b/systemd/enodia-sentinel.service index 6f9bdd5..c2637d5 100644 --- a/systemd/enodia-sentinel.service +++ b/systemd/enodia-sentinel.service @@ -1,5 +1,5 @@ [Unit] -Description=Enodia Sentinel - endpoint detection and response agent +Description=Enodia Sentinel - IDS/IPS/EDR agent After=network.target Documentation=https://github.com/Enodia/enodia-sentinel