luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Describe Sentinel as endpoint detection and response

Browse source
This commit is contained in:
Luna 2026-06-13 05:49:34 -07:00
parent a51478fa22
commit 812cf0c836
6 changed files with 28 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

19
README.md
View file

@ -1,8 +1,8 @@
# Enodia Sentinel
A Linux host security platform: intrusion detection, file/package integrity,
anti-rootkit cross-checks, tamper-evidence, forensic snapshots, push alerts, and
a read-only operator console.
A Linux endpoint detection and response platform: intrusion detection,
file/package integrity, anti-rootkit cross-checks, tamper-evidence, forensic
snapshots, push alerts, response planning, and a read-only operator console.
The current daemon continuously runs detectors over live system state —
processes, sockets, file descriptors, the SUID inventory, sensitive files, the
@ -17,8 +17,8 @@ the package database was tampered with, and what to do next."*
## Product direction
Enodia is becoming more than an IDS. The local detector is the first layer of a
broader host security platform:
Enodia Sentinel is an endpoint detection and response system. IDS-style
signatures are one detection layer inside a broader host security platform:
| Function | Current capability | Direction |
|---|---|---|
@ -438,7 +438,7 @@ change into the normal alert/snapshot/push pipeline (`fim_modified` `sid 100017`
## False positives & triage
A host IDS that cries wolf gets ignored, so Sentinel ships explicit tooling to
An EDR that cries wolf gets ignored, so Sentinel ships explicit tooling to
separate benign noise from real findings — built on **provenance**: a binary
shipped by your package manager (`pacman`/`dpkg`/`rpm`) is overwhelmingly likely
to be legitimate (the same idea behind OSSEC's rootcheck and AIDE).
@ -505,9 +505,10 @@ conscious tradeoff documented in the file itself.
## Roadmap
The short version: Enodia grows from local HIDS into a host security platform:
incident grouping, posture checks, response planning, richer eBPF telemetry,
fleet health, external anchors, and eventually attestation-ready assurance.
The short version: Enodia grows from local endpoint detection and response into
a host security platform: incident grouping, posture checks, response planning,
richer eBPF telemetry, fleet health, external anchors, and eventually
attestation-ready assurance.
See [docs/ROADMAP.md](docs/ROADMAP.md) for the release tracks and phased plan.
The polling daemon isn't throwaway — it's the **oracle**: every signature is a