Generate event rule documentation

README.md

@@ -43,6 +43,8 @@ Project docs:
   workflow, baseline hygiene, and evidence export.
 - [IR runbooks](docs/RUNBOOKS.md) — confirm/preserve/contain/recover playbooks
   per alert: reverse shells, persistence, trojaned binaries, rootkits, tampering.
+- [Rule reference](docs/RULES.md) — generated event-rule documentation: SID,
+  signature, classtype, match fields, expected false positives, and drills.
 
 > **Two implementations, on purpose.** The project began as a bash prototype
 > (`src/sentinel.sh`, kept as the regression **oracle**) and was re-architected
@@ -103,6 +105,7 @@ They can inspect and test the active event rule set with:
 enodia-sentinel rules list
 enodia-sentinel rules show 100002
 enodia-sentinel rules test event.json
+enodia-sentinel rules docs
 ```
 
 The layer is **fail-safe**: if `bcc`/root/BTF aren't available it logs the