luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Frame Sentinel as IDS IPS and EDR

Browse source
This commit is contained in:
Luna 2026-06-13 05:59:03 -07:00
parent 1a5b6f1d8d
commit 6a09fbb7f9
10 changed files with 47 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

9
CLAUDE.md
View file

@ -4,14 +4,17 @@ Guidance for Claude or Claude Code agents working on Enodia Sentinel.
## Project Shape
Enodia Sentinel is a zero-runtime-dependency Linux host security platform. The
Enodia Sentinel is a zero-runtime-dependency Linux IDS/IPS/EDR platform. The
core agent is pure Python standard library and should stay that way unless a
dependency has clear security/operator value that cannot reasonably be achieved
with stdlib.
with stdlib. Its IPS scope is explicit prevention workflow: posture hardening,
containment planning, and future reviewed `--apply` actions, not silent inline
network blocking or automatic host mutation.
Primary functions:
- Detect: poll detectors plus optional eBPF exec rules.
- Detect: poll detectors plus optional eBPF exec/syscall rules.
- Prevent: posture findings plus reviewed containment/recovery plans.
- Verify: FIM, package DB anchor, signed-package verification, rootcheck.
- Investigate: text/JSON snapshots, incidents, HTTPS management console.
- Respond: dry-run plans first; any state-changing action must be explicit,