luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Frame Sentinel as IDS IPS and EDR

Browse source
This commit is contained in:
Luna 2026-06-13 05:59:03 -07:00
parent 1a5b6f1d8d
commit 6a09fbb7f9
10 changed files with 47 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/THREAT_MODEL.md
View file

@ -80,12 +80,16 @@ Sentinel assumes:
- The dashboard is read-only by design; it can display dry-run response plans
but does not execute containment commands.
- The current product does not perform automatic containment.
- Sentinel's IPS scope is explicit prevention workflow: posture hardening,
containment planning, and future reviewed `--apply` actions. It is not an
inline network appliance and does not silently rewrite host state.
## Security Controls Already Present
| Control | Purpose |
|---|---|
| Hardened systemd unit | Limits daemon write surface and runtime privilege where possible. |
| Explicit IPS workflow | Turns detections into reviewed prevention/containment plans without automatic remediation. |
| Cooldown deduplication | Prevents alert storms from one persistent condition. |
| Snapshot retention | Preserves evidence while bounding local disk growth. |
| FIM self-watch | Detects changes to Sentinel's own files and service definitions. |