Describe Sentinel as endpoint detection and response

README.md

@@ -1,8 +1,8 @@
 # Enodia Sentinel
 
-A Linux host security platform: intrusion detection, file/package integrity,
+A Linux endpoint detection and response platform: intrusion detection,
-anti-rootkit cross-checks, tamper-evidence, forensic snapshots, push alerts, and
+file/package integrity, anti-rootkit cross-checks, tamper-evidence, forensic
-a read-only operator console.
+snapshots, push alerts, response planning, and a read-only operator console.
 
 The current daemon continuously runs detectors over live system state —
 processes, sockets, file descriptors, the SUID inventory, sensitive files, the
@@ -17,8 +17,8 @@ the package database was tampered with, and what to do next."*
 
 ## Product direction
 
-Enodia is becoming more than an IDS. The local detector is the first layer of a
+Enodia Sentinel is an endpoint detection and response system. IDS-style
-broader host security platform:
+signatures are one detection layer inside a broader host security platform:
 
 | Function | Current capability | Direction |
 |---|---|---|
@@ -438,7 +438,7 @@ change into the normal alert/snapshot/push pipeline (`fim_modified` `sid 100017`
 
 ## False positives & triage
 
-A host IDS that cries wolf gets ignored, so Sentinel ships explicit tooling to
+An EDR that cries wolf gets ignored, so Sentinel ships explicit tooling to
 separate benign noise from real findings — built on **provenance**: a binary
 shipped by your package manager (`pacman`/`dpkg`/`rpm`) is overwhelmingly likely
 to be legitimate (the same idea behind OSSEC's rootcheck and AIDE).
@@ -505,9 +505,10 @@ conscious tradeoff documented in the file itself.
 
 ## Roadmap
 
-The short version: Enodia grows from local HIDS into a host security platform:
+The short version: Enodia grows from local endpoint detection and response into
-incident grouping, posture checks, response planning, richer eBPF telemetry,
+a host security platform: incident grouping, posture checks, response planning,
-fleet health, external anchors, and eventually attestation-ready assurance.
+richer eBPF telemetry, fleet health, external anchors, and eventually
+attestation-ready assurance.
 
 See [docs/ROADMAP.md](docs/ROADMAP.md) for the release tracks and phased plan.
 The polling daemon isn't throwaway — it's the **oracle**: every signature is a

docs/ROADMAP.md

@@ -1,8 +1,9 @@
 # Enodia Sentinel Roadmap
 
-This roadmap moves Enodia Sentinel from a host IDS into a host security platform:
+This roadmap moves Enodia Sentinel from single-host endpoint detection and
-detect, verify, investigate, respond, and assure. Dates are intentionally not
+response into a fuller host security platform: detect, verify, investigate,
-promised here; the sequence matters more than calendar precision.
+respond, and assure. Dates are intentionally not promised here; the sequence
+matters more than calendar precision.
 
 ## Release Tracks
 
@@ -145,7 +146,7 @@ Exit criteria:
 - Multi-stage correlation raises one higher-confidence incident without hiding
   the underlying raw alerts.
 
-## v1.1.1: IDS Quality and Rule Operations
+## v1.1.1: Detection Quality and Rule Operations
 
 Purpose: make detection coverage easier to audit, tune, and extend without
 turning Sentinel into a noisy rules dump.
@@ -170,7 +171,7 @@ Exit criteria:
 
 - Operators can inspect, test, document, and tune detection rules without
   reading Python source.
-- Every shipped IDS rule has reproducible fixture/drill coverage and stable
+- Every shipped detection rule has reproducible fixture/drill coverage and stable
   operator documentation.
 
 ## v1.2: Fleet Mode

docs/SPECIFICATION.md

@@ -1,11 +1,12 @@
 # Enodia Sentinel Specification
 
-This document defines Enodia Sentinel as a host security platform, not only a
+This document defines Enodia Sentinel as an endpoint detection and response
-signature IDS. The current implementation is a local Linux sensor with evidence
+system, not only a signature IDS. The current implementation is a local Linux
-capture, integrity monitoring, anti-rootkit checks, a dashboard, and alert
+sensor with evidence capture, integrity monitoring, anti-rootkit checks, a
-delivery. The intended product is a defensive control plane for a host or small
+dashboard, alert delivery, and dry-run response planning. The intended product
-fleet: detect compromise, prove what changed, preserve useful evidence, guide
+is a defensive control plane for a host or small fleet: detect compromise, prove
-response, and make sensor tampering visible.
+what changed, preserve useful evidence, guide response, and make sensor
+tampering visible.
 
 ## Product Definition
 

packaging/PKGBUILD

@@ -2,12 +2,12 @@
 pkgname=enodia-sentinel
 pkgver=0.6.0
 pkgrel=1
-pkgdesc="Host intrusion-detection daemon — signature-based detection of reverse shells, LD_PRELOAD rootkits, fileless malware, and persistence tampering"
+pkgdesc="Linux endpoint detection and response agent with IDS, integrity, anti-rootkit, and forensic response features"
 arch=('any')
 url="https://github.com/Enodia/enodia-sentinel"
 license=('GPL-3.0-or-later')
 depends=('python>=3.11' 'iproute2' 'procps-ng')
-optdepends=('python-bpfcc: eBPF event-driven execve monitor (catches short-lived processes)'
+optdepends=('python-bpfcc: eBPF event-driven execve/syscall monitors (catches short-lived processes and memory telemetry)'
             'bpftrace: execve tracing of short-lived processes in snapshots'
             'libnotify: desktop notifications on alert')
 backup=('etc/enodia-sentinel.toml')

pyproject.toml

@@ -5,12 +5,12 @@ build-backend = "setuptools.build_meta"
 [project]
 name = "enodia-sentinel"
 version = "0.7.0"
-description = "Linux host security platform — detection, integrity, anti-rootkit checks, tamper-evidence, and forensic snapshots"
+description = "Linux endpoint detection and response platform — detection, integrity, anti-rootkit checks, tamper-evidence, and forensic snapshots"
 readme = "README.md"
 requires-python = ">=3.11"
 license = { text = "GPL-3.0-or-later" }
 authors = [{ name = "Enodia" }]
-keywords = ["security", "ids", "hids", "detection", "linux", "forensics"]
+keywords = ["security", "edr", "ids", "hids", "detection", "linux", "forensics", "response"]
 classifiers = [
     "License :: OSI Approved :: GNU General Public License v3 or later (GPLv3+)",
     "Operating System :: POSIX :: Linux",

systemd/enodia-sentinel.service

@@ -1,5 +1,5 @@
 [Unit]
-Description=Enodia Sentinel - host intrusion detection daemon
+Description=Enodia Sentinel - endpoint detection and response agent
 After=network.target
 Documentation=https://github.com/Enodia/enodia-sentinel