luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Generate event rule documentation

Browse source
This commit is contained in:
Luna 2026-06-15 18:52:28 -07:00
parent e43d7689a0
commit 7f4d5b42fd
8 changed files with 378 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

5
docs/COMMAND_REFERENCE.md
View file

@ -74,6 +74,7 @@ enodia-sentinel rules show <sid>
enodia-sentinel rules show <sid> --json
enodia-sentinel rules test <event-json>
enodia-sentinel rules test <event-json> --json
enodia-sentinel rules docs
```
Inspects and tests event-driven detection rules without reading source code.
@ -81,7 +82,9 @@ Inspects and tests event-driven detection rules without reading source code.
from `exec_rules_file`. `rules show <sid>` prints the rule metadata and match
conditions. `rules test <event-json>` loads an exec or syscall event JSON file,
runs the matching rule engine, and prints any alerts that would fire. Use `-`
instead of a path to read the event JSON from stdin.
instead of a path to read the event JSON from stdin. `rules docs` emits Markdown
rule documentation from the active rule metadata; the built-in snapshot lives in
[RULES.md](RULES.md).
Exec event JSON shape: