luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add event-driven memory syscall telemetry

Browse source
This commit is contained in:
Luna 2026-06-13 05:45:30 -07:00
parent 893409b549
commit a51478fa22
18 changed files with 589 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

6
config/enodia-sentinel.toml
View file

@ -153,10 +153,10 @@ posture_sudoers_dir = "/etc/sudoers.d"
# posture_path = [] # PATH dirs to audit; empty = safe default set
# --- eBPF event layer ----------------------------------------------------
# Event-driven execve monitor: catches short-lived processes the poll loop
# misses, matched against the Snort-style rule engine. Requires python-bpfcc
# and root; degrades gracefully to polling otherwise.
# Event-driven eBPF monitors: catch short-lived activity the poll loop misses.
# Requires python-bpfcc and root; degrades gracefully to polling otherwise.
ebpf_exec_monitor = true
ebpf_syscall_monitor = true
# Optional path to a TOML file of extra [[exec_rules]] (sid/msg/severity/
# classtype + path_prefixes/exec_comm/parent_comm/argv_regex).
exec_rules_file = ""