luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Describe Sentinel as endpoint detection and response

Browse source
This commit is contained in:
Luna 2026-06-13 05:49:34 -07:00
parent a51478fa22
commit 812cf0c836
6 changed files with 28 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

11
docs/ROADMAP.md
View file

@ -1,8 +1,9 @@
# Enodia Sentinel Roadmap
This roadmap moves Enodia Sentinel from a host IDS into a host security platform:
detect, verify, investigate, respond, and assure. Dates are intentionally not
promised here; the sequence matters more than calendar precision.
This roadmap moves Enodia Sentinel from single-host endpoint detection and
response into a fuller host security platform: detect, verify, investigate,
respond, and assure. Dates are intentionally not promised here; the sequence
matters more than calendar precision.
## Release Tracks
@ -145,7 +146,7 @@ Exit criteria:
- Multi-stage correlation raises one higher-confidence incident without hiding
the underlying raw alerts.
## v1.1.1: IDS Quality and Rule Operations
## v1.1.1: Detection Quality and Rule Operations
Purpose: make detection coverage easier to audit, tune, and extend without
turning Sentinel into a noisy rules dump.
@ -170,7 +171,7 @@ Exit criteria:
- Operators can inspect, test, document, and tune detection rules without
reading Python source.
- Every shipped IDS rule has reproducible fixture/drill coverage and stable
- Every shipped detection rule has reproducible fixture/drill coverage and stable
operator documentation.
## v1.2: Fleet Mode

13
docs/SPECIFICATION.md
View file

@ -1,11 +1,12 @@
# Enodia Sentinel Specification
This document defines Enodia Sentinel as a host security platform, not only a
signature IDS. The current implementation is a local Linux sensor with evidence
capture, integrity monitoring, anti-rootkit checks, a dashboard, and alert
delivery. The intended product is a defensive control plane for a host or small
fleet: detect compromise, prove what changed, preserve useful evidence, guide
response, and make sensor tampering visible.
This document defines Enodia Sentinel as an endpoint detection and response
system, not only a signature IDS. The current implementation is a local Linux
sensor with evidence capture, integrity monitoring, anti-rootkit checks, a
dashboard, alert delivery, and dry-run response planning. The intended product
is a defensive control plane for a host or small fleet: detect compromise, prove
what changed, preserve useful evidence, guide response, and make sensor
tampering visible.
## Product Definition