luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add host event rules for bind and capability activity

Browse source
This commit is contained in:
Luna 2026-07-10 04:11:33 -07:00
parent b40ac4252c
commit 9784033f86
No known key found for this signature in database
12 changed files with 316 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/ROADMAP.md
View file

@ -136,10 +136,9 @@ Purpose: reduce blind spots and connect related signals.
flags interpreters opening listeners on unusual local ports, with local-port
match conditions and a replayable fixture.
- ✅ Continue generalizing the rule engine across more typed host events:
`file_write`, `chmod/chown`, and `setuid/setgid` now have built-in rules,
typed event parsing, fixtures, and rule-operation tests.
- Continue extending typed host-event coverage to:
`bind`, `accept`, `capset`, and module-load events.
`file_write`, `chmod/chown`, `setuid/setgid`, `bind`, `accept`, `capset`,
and module-load now have built-in rules, typed event parsing, fixtures, and
rule-operation tests.
- Keep rules declarative and Snort-like:
`sid`, `msg`, `severity`, `classtype`, `event`, and match fields such as
process name, parent process, argv regex, path prefix, peer IP/port, UID/GID,