luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(go): port memory-map detector tranche

Browse source
This commit is contained in:
Luna 2026-07-11 01:19:56 -07:00
parent c6f7219de8
commit 6a27e6e770
No known key found for this signature in database
13 changed files with 377 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/SURICATA_ASSIMILATION.md
View file

@ -228,9 +228,10 @@ signature keeps `sid` / `signature` / `classtype` / tests / docs.
equivalent, poll detectors ported, JSON output matching schemas. Runs
alongside Python; harness compares both. *In progress:* the isolated
`go-agent/` sidecar now has stdlib config loading, an injectable `/proc`
process/file-descriptor and `ss` socket view, the JSONL sweep loop, and
fixture parity for `reverse_shell`, `ld_preload`, `deleted_exe`,
`input_snooper`, `credential_access`, `stealth_network`, and `egress`;
process/file-descriptor/memory-map and `ss` socket view, the JSONL sweep
loop, and fixture parity for `reverse_shell`, `ld_preload`, `deleted_exe`,
`input_snooper`, `credential_access`, `stealth_network`, the
`memory_obfuscation` cohort, and `egress`;
Python remains the production agent.
- **Phase 2 — eBPF via `cilium/ebpf`.** Port exec/syscall rules; drop the
bcc/Python runtime dependency; single static binary.