luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Expand TUI guidance and host detection coverage

Browse source
This commit is contained in:
Luna 2026-07-09 19:16:27 -07:00
parent 3b037646d2
commit 8194d13734
20 changed files with 414 additions and 42 deletions
Download patch file Download diff file Expand all files Collapse all files

12
README.md
View file

@ -72,7 +72,7 @@ EDRs are built on:
| `input_snooper` | A non-allowlisted process holding `/dev/input`, `/dev/uinput`, or HID raw devices open | Keyloggers have to read keystroke/event devices somewhere; expected compositors/remappers are tunable |
| `credential_access` | A non-allowlisted process with shadow files, private SSH keys, browser stores, or secret profiles open | Credential harvesters have to open the material they steal; legitimate auth/keyring/browser readers are tunable |
| `stealth_network` | Raw, SCTP, DCCP, packet, MPTCP, TIPC, XDP, or vsock activity | Covert channels often avoid ordinary TCP/UDP paths; expected network managers/sniffers are tunable |
| `memory_obfuscation` | Executable anonymous/memfd/deleted mappings, RWX pages, or mapped process-hiding libraries | Encrypted/packed payloads still need executable memory after decrypting; hide libraries must be mapped to hook tools |
| `memory_obfuscation` | Executable anonymous/memfd/deleted mappings, RWX pages, mapped process-hiding libraries, or executable `.so` mappings from writable runtime paths | Encrypted/packed payloads still need executable memory after decrypting; hide/injection libraries must be mapped to hook tools |
| `new_listener` | A listening port absent from the startup baseline | Bind shells/backdoors have to listen somewhere |
| `new_suid` | A new SUID/SGID binary (critical in a writable dir) | A SUID `/tmp` binary is a textbook privesc trick |
| `persistence` | Changes to cron, systemd units, `authorized_keys`, rc files | Persistence has to write somewhere that survives reboot |
@ -229,11 +229,15 @@ enodia-sentinel-tui
The TUI mirrors the read-only management console for terminal operators:
status, recent alerts, incidents, posture findings, integrity/watchdog state,
incident timelines, event-rule metadata, event tail, and dry-run response-plan
previews.
previews. It includes plain-language view descriptions and a beginner workflow:
start at `1` Status, then use `3` Incidents, `4` Timeline, `9` Response Plans,
and `6` Integrity. The TUI displays evidence and suggested commands but does not
change the host.
Keys: `1` status, `2` alerts, `3` incidents, `4` timelines, `5` posture,
`6` integrity, `7` rules, `8` events, `9` response plans, `r` refresh, `/` filter, `:`
command mode, `Tab` complete command names, `q` quit.
`6` integrity, `7` rules, `8` events, `9` response plans, `n`/`b` next/back in
the beginner workflow, `r` refresh, `/` filter, `:` command mode, `Tab` complete
command names, `q` quit.
Shell completion is generated without extra dependencies: