luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add Suricata assimilation design

Browse source
This commit is contained in:
Luna 2026-07-10 04:16:31 -07:00
parent 9784033f86
commit 8d929b50bd
No known key found for this signature in database
4 changed files with 294 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
README.md
View file

@ -54,6 +54,9 @@ Project docs:
signature, classtype, match fields, expected false positives, and drills.
- [Fleet collector design](docs/FLEET_DESIGN.md) — optional v1.2 collector
boundaries for small multi-host deployments.
- [Suricata assimilation design](docs/SURICATA_ASSIMILATION.md) —
forward-looking plan for host-scoped Suricata model adoption, Go migration,
sessions, EVE-style events, and triggered forensic packet capture.
> **Two implementations, on purpose.** The project began as a bash prototype
> (`src/sentinel.sh`, kept as the regression **oracle**) and was re-architected