luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Frame Sentinel as IDS IPS and EDR

Browse source
This commit is contained in:
Luna 2026-06-13 05:59:03 -07:00
parent 1a5b6f1d8d
commit 6a09fbb7f9
10 changed files with 47 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

23
README.md
View file

@ -1,8 +1,9 @@
# Enodia Sentinel
A Linux endpoint detection and response platform: intrusion detection,
file/package integrity, anti-rootkit cross-checks, tamper-evidence, forensic
snapshots, push alerts, response planning, and a read-only operator console.
A Linux IDS/IPS/EDR platform: intrusion detection, explicit prevention and
containment workflows, endpoint detection and response, file/package integrity,
anti-rootkit cross-checks, tamper-evidence, forensic snapshots, push alerts, and
a read-only operator console.
The current daemon continuously runs detectors over live system state —
processes, sockets, file descriptors, the SUID inventory, sensitive files, the
@ -17,12 +18,16 @@ the package database was tampered with, and what to do next."*
## Product direction
Enodia Sentinel is an endpoint detection and response system. IDS-style
signatures are one detection layer inside a broader host security platform:
Enodia Sentinel is an IDS, IPS, and EDR system. IDS-style signatures identify
suspicious host behavior, IPS workflows turn those findings into explicit
containment/prevention plans, and EDR features preserve evidence for triage,
investigation, and recovery. Automatic inline blocking is intentionally gated
behind reviewed response workflows rather than silent remediation.
| Function | Current capability | Direction |
|---|---|---|
| Detect | Poll detectors + eBPF exec rules | More event sources and correlation |
| Prevent | Posture checks + dry-run containment plans | Audited, explicit `--apply` workflows |
| Verify | FIM, package DB anchor, signed-package checks | External anchors and signed evidence |
| Investigate | Text/JSON snapshots, dashboard, triage | Incident timelines and evidence export |
| Respond | Human guidance today | Dry-run response plans and audited containment |
@ -510,10 +515,10 @@ conscious tradeoff documented in the file itself.
## Roadmap
The short version: Enodia grows from local endpoint detection and response into
a host security platform: incident grouping, posture checks, response planning,
richer eBPF telemetry, fleet health, external anchors, and eventually
attestation-ready assurance.
The short version: Enodia grows from a local IDS/IPS/EDR agent into a host
security platform: incident grouping, posture checks, response planning, richer
eBPF telemetry, fleet health, external anchors, and eventually attestation-ready
assurance.
See [docs/ROADMAP.md](docs/ROADMAP.md) for the release tracks and phased plan.
The polling daemon isn't throwaway — it's the **oracle**: every signature is a