Add host event rules for bind and capability activity

enodia_sentinel/ruleops.py

@@ -174,6 +174,10 @@ def _host_rule_record(rule: HostRule, origin: str) -> dict[str, Any]:
         conditions["target_uids"] = sorted(rule.target_uids)
     if rule.target_gids:
         conditions["target_gids"] = sorted(rule.target_gids)
+    if rule.capabilities_any:
+        conditions["capabilities_any"] = sorted(rule.capabilities_any)
+    if rule.module_names:
+        conditions["module_names"] = sorted(rule.module_names)
     if rule.argv_regex:
         conditions["argv_regex"] = rule.argv_regex
     return {
@@ -280,6 +284,34 @@ _RULE_DOCS: dict[int, dict[str, Any]] = {
         ],
         "drill": "Use `rules test` with a `listen` event whose `comm` is an interpreter and whose `local_port` is not a common service port.",
     },
+    100073: {
+        "false_positives": [
+            "Developer or diagnostic scripts binding high local ports intentionally.",
+            "Short-lived local service wrappers that bind before handing sockets to a supervised process.",
+        ],
+        "drill": "Use `rules test` with a `bind` event whose `comm` is an interpreter and whose `local_port` is not a common service port.",
+    },
+    100076: {
+        "false_positives": [
+            "Developer servers or test harnesses accepting inbound public traffic from an interpreter.",
+            "Administrative troubleshooting with temporary netcat/socat listeners.",
+        ],
+        "drill": "Use `rules test` with an `accept` event whose `comm` is an interpreter, public `peer_ip`, and unusual `local_port`.",
+    },
+    100077: {
+        "false_positives": [
+            "Privileged maintenance scripts that intentionally adjust capabilities during controlled administration.",
+            "Container or network lab setup scripts using interpreters to configure namespaces or packet capture.",
+        ],
+        "drill": "Use `rules test` with a `capset` event containing a sensitive capability such as `CAP_SYS_ADMIN`.",
+    },
+    100078: {
+        "false_positives": [
+            "Kernel development labs loading locally built modules from temporary build directories.",
+            "Driver troubleshooting sessions that intentionally test an unsigned module from a writable path.",
+        ],
+        "drill": "Use `rules test` with a `module_load` event whose `path` is under `/tmp`, `/var/tmp`, `/dev/shm`, or `/run/user`.",
+    },
 }
 
 
@@ -368,6 +400,11 @@ def _host_event(event: dict[str, Any]) -> HostEvent:
         target_uid=_to_int(event.get("target_uid", event.get("uid_target", -1))),
         target_gid=_to_int(event.get("target_gid", event.get("gid_target", -1))),
         mode=_to_int(event.get("mode", 0)),
+        capabilities=_to_str_tuple(event.get(
+            "capabilities",
+            event.get("caps", event.get("cap_effective", event.get("capability", ()))),
+        )),
+        module_name=str(event.get("module_name", event.get("name", ""))),
     )
 
 
@@ -375,3 +412,11 @@ def _to_int(value: Any) -> int:
     if isinstance(value, str):
         return int(value, 0)
     return int(value)
+
+
+def _to_str_tuple(value: Any) -> tuple[str, ...]:
+    if value is None:
+        return ()
+    if isinstance(value, str):
+        return (value.upper(),) if value else ()
+    return tuple(str(item).upper() for item in value)