Frame Sentinel as IDS IPS and EDR

CLAUDE.md

@@ -4,14 +4,17 @@ Guidance for Claude or Claude Code agents working on Enodia Sentinel.
 
 ## Project Shape
 
-Enodia Sentinel is a zero-runtime-dependency Linux host security platform. The
+Enodia Sentinel is a zero-runtime-dependency Linux IDS/IPS/EDR platform. The
 core agent is pure Python standard library and should stay that way unless a
 dependency has clear security/operator value that cannot reasonably be achieved
-with stdlib.
+with stdlib. Its IPS scope is explicit prevention workflow: posture hardening,
+containment planning, and future reviewed `--apply` actions, not silent inline
+network blocking or automatic host mutation.
 
 Primary functions:
 
-- Detect: poll detectors plus optional eBPF exec rules.
+- Detect: poll detectors plus optional eBPF exec/syscall rules.
+- Prevent: posture findings plus reviewed containment/recovery plans.
 - Verify: FIM, package DB anchor, signed-package verification, rootcheck.
 - Investigate: text/JSON snapshots, incidents, HTTPS management console.
 - Respond: dry-run plans first; any state-changing action must be explicit,

README.md

@@ -1,8 +1,9 @@
 # Enodia Sentinel
 
-A Linux endpoint detection and response platform: intrusion detection,
+A Linux IDS/IPS/EDR platform: intrusion detection, explicit prevention and
-file/package integrity, anti-rootkit cross-checks, tamper-evidence, forensic
+containment workflows, endpoint detection and response, file/package integrity,
-snapshots, push alerts, response planning, and a read-only operator console.
+anti-rootkit cross-checks, tamper-evidence, forensic snapshots, push alerts, and
+a read-only operator console.
 
 The current daemon continuously runs detectors over live system state —
 processes, sockets, file descriptors, the SUID inventory, sensitive files, the
@@ -17,12 +18,16 @@ the package database was tampered with, and what to do next."*
 
 ## Product direction
 
-Enodia Sentinel is an endpoint detection and response system. IDS-style
+Enodia Sentinel is an IDS, IPS, and EDR system. IDS-style signatures identify
-signatures are one detection layer inside a broader host security platform:
+suspicious host behavior, IPS workflows turn those findings into explicit
+containment/prevention plans, and EDR features preserve evidence for triage,
+investigation, and recovery. Automatic inline blocking is intentionally gated
+behind reviewed response workflows rather than silent remediation.
 
 | Function | Current capability | Direction |
 |---|---|---|
 | Detect | Poll detectors + eBPF exec rules | More event sources and correlation |
+| Prevent | Posture checks + dry-run containment plans | Audited, explicit `--apply` workflows |
 | Verify | FIM, package DB anchor, signed-package checks | External anchors and signed evidence |
 | Investigate | Text/JSON snapshots, dashboard, triage | Incident timelines and evidence export |
 | Respond | Human guidance today | Dry-run response plans and audited containment |
@@ -510,10 +515,10 @@ conscious tradeoff documented in the file itself.
 
 ## Roadmap
 
-The short version: Enodia grows from local endpoint detection and response into
+The short version: Enodia grows from a local IDS/IPS/EDR agent into a host
-a host security platform: incident grouping, posture checks, response planning,
+security platform: incident grouping, posture checks, response planning, richer
-richer eBPF telemetry, fleet health, external anchors, and eventually
+eBPF telemetry, fleet health, external anchors, and eventually attestation-ready
-attestation-ready assurance.
+assurance.
 
 See [docs/ROADMAP.md](docs/ROADMAP.md) for the release tracks and phased plan.
 The polling daemon isn't throwaway — it's the **oracle**: every signature is a

docs/ROADMAP.md

@@ -1,15 +1,16 @@
 # Enodia Sentinel Roadmap
 
-This roadmap moves Enodia Sentinel from single-host endpoint detection and
+This roadmap moves Enodia Sentinel from a single-host IDS/IPS/EDR agent into a
-response into a fuller host security platform: detect, verify, investigate,
+fuller host security platform: detect, prevent, verify, investigate, respond,
-respond, and assure. Dates are intentionally not promised here; the sequence
+and assure. Dates are intentionally not promised here; the sequence matters more
-matters more than calendar precision.
+than calendar precision.
 
 ## Release Tracks
 
 | Track | Goal |
 |---|---|
 | Sensor | Better host telemetry, event capture, and detection coverage. |
+| Prevention | Safe containment and recovery actions that start as dry-run plans and require explicit review before any state change. |
 | Integrity | Stronger proof that files, packages, baselines, and Sentinel itself were not silently modified. |
 | Incident | Group alerts, build timelines, and export evidence. |
 | Response | Add safe, auditable containment and recovery workflows. |

docs/SPECIFICATION.md

@@ -1,12 +1,12 @@
 # Enodia Sentinel Specification
 
-This document defines Enodia Sentinel as an endpoint detection and response
+This document defines Enodia Sentinel as an IDS, IPS, and EDR system, not only a
-system, not only a signature IDS. The current implementation is a local Linux
+signature IDS. The current implementation is a local Linux sensor with evidence
-sensor with evidence capture, integrity monitoring, anti-rootkit checks, a
+capture, integrity monitoring, anti-rootkit checks, a dashboard, alert delivery,
-dashboard, alert delivery, and dry-run response planning. The intended product
+and dry-run prevention/response planning. The intended product is a defensive
-is a defensive control plane for a host or small fleet: detect compromise, prove
+control plane for a host or small fleet: detect compromise, prevent or contain
-what changed, preserve useful evidence, guide response, and make sensor
+known-bad behavior through explicit operator workflows, prove what changed,
-tampering visible.
+preserve useful evidence, guide response, and make sensor tampering visible.
 
 ## Product Definition
 
@@ -15,11 +15,12 @@ as a local daemon, observes high-signal host behavior, records forensic context
 when something suspicious happens, and exposes the result through local files,
 JSON, a read-only dashboard, push notifications, and command-line tools.
 
-The long-term product should combine five functions:
+The long-term product should combine six functions:
 
 | Function | Purpose |
 |---|---|
 | Detection | Find active compromise behavior: reverse shells, fileless execution, new listeners, suspicious egress, persistence edits, and privilege-escalation artifacts. |
+| Prevention | Recommend and, after explicit review, apply containment actions such as stopping malicious processes, blocking C2 peers, disabling persistence, or quarantining files. |
 | Integrity | Prove whether important files, packages, baselines, and Sentinel's own footprint changed. |
 | Evidence | Capture enough context for incident response without forcing the operator to reproduce a live state after the attacker is gone. |
 | Response | Provide safe, explicit operator workflows for triage, containment, and recovery. |

docs/THREAT_MODEL.md

@@ -80,12 +80,16 @@ Sentinel assumes:
 - The dashboard is read-only by design; it can display dry-run response plans
   but does not execute containment commands.
 - The current product does not perform automatic containment.
+- Sentinel's IPS scope is explicit prevention workflow: posture hardening,
+  containment planning, and future reviewed `--apply` actions. It is not an
+  inline network appliance and does not silently rewrite host state.
 
 ## Security Controls Already Present
 
 | Control | Purpose |
 |---|---|
 | Hardened systemd unit | Limits daemon write surface and runtime privilege where possible. |
+| Explicit IPS workflow | Turns detections into reviewed prevention/containment plans without automatic remediation. |
 | Cooldown deduplication | Prevents alert storms from one persistent condition. |
 | Snapshot retention | Preserves evidence while bounding local disk growth. |
 | FIM self-watch | Detects changes to Sentinel's own files and service definitions. |

enodia_sentinel/__init__.py

@@ -1,9 +1,9 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
-"""Enodia Sentinel — a Linux host security platform.
+"""Enodia Sentinel — a Linux IDS/IPS/EDR platform.
 
-Detection, file/package integrity, anti-rootkit checks, tamper-evidence,
+Detection, explicit prevention workflows, file/package integrity, anti-rootkit
-forensic snapshots, and operator workflows. The Python re-architecture of the
+checks, tamper-evidence, forensic snapshots, and operator response. The Python
-bash v0 prototype.
+re-architecture of the bash v0 prototype.
 """
 
 __version__ = "0.7.0"

enodia_sentinel/cli.py

@@ -51,7 +51,7 @@ def _cmd_check(cfg: Config) -> int:
 def main(argv: list[str] | None = None) -> int:
     parser = argparse.ArgumentParser(
         prog="enodia-sentinel",
-        description="Linux host security platform.",
+        description="Linux IDS/IPS/EDR platform.",
     )
     parser.add_argument("--version", action="version",
                         version=f"enodia-sentinel {__version__}")

packaging/PKGBUILD

@@ -2,7 +2,7 @@
 pkgname=enodia-sentinel
 pkgver=0.6.0
 pkgrel=1
-pkgdesc="Linux endpoint detection and response agent with IDS, integrity, anti-rootkit, and forensic response features"
+pkgdesc="Linux IDS/IPS/EDR agent with integrity, anti-rootkit, forensic evidence, and explicit prevention workflows"
 arch=('any')
 url="https://github.com/Enodia/enodia-sentinel"
 license=('GPL-3.0-or-later')

pyproject.toml

@@ -5,12 +5,12 @@ build-backend = "setuptools.build_meta"
 [project]
 name = "enodia-sentinel"
 version = "0.7.0"
-description = "Linux endpoint detection and response platform — detection, integrity, anti-rootkit checks, tamper-evidence, and forensic snapshots"
+description = "Linux IDS/IPS/EDR platform — detection, explicit prevention workflows, integrity, anti-rootkit checks, and forensic snapshots"
 readme = "README.md"
 requires-python = ">=3.11"
 license = { text = "GPL-3.0-or-later" }
 authors = [{ name = "Enodia" }]
-keywords = ["security", "edr", "ids", "hids", "detection", "linux", "forensics", "response"]
+keywords = ["security", "edr", "ids", "ips", "hids", "detection", "prevention", "linux", "forensics", "response"]
 classifiers = [
     "License :: OSI Approved :: GNU General Public License v3 or later (GPLv3+)",
     "Operating System :: POSIX :: Linux",

systemd/enodia-sentinel.service

@@ -1,5 +1,5 @@
 [Unit]
-Description=Enodia Sentinel - endpoint detection and response agent
+Description=Enodia Sentinel - IDS/IPS/EDR agent
 After=network.target
 Documentation=https://github.com/Enodia/enodia-sentinel