luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add event-driven memory syscall telemetry

Browse source
This commit is contained in:
Luna 2026-06-13 05:45:30 -07:00
parent 893409b549
commit a51478fa22
18 changed files with 589 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

10
docs/SPECIFICATION.md
View file

@ -64,10 +64,12 @@ against cached process and socket data:
### Event Detection
An optional bcc eBPF `execve` monitor feeds a declarative rule engine. This
closes the polling gap for short-lived commands and supports custom TOML rules
without code changes. Failure is fail-safe: if the probe cannot load, polling
continues.
Optional bcc eBPF monitors feed event rule engines. The `execve` stream closes
the polling gap for short-lived commands and supports custom TOML rules without
code changes. The syscall stream watches short-lived memory and anti-analysis
behavior: RWX `mprotect`/`mmap`, `memfd_create`, sensitive `ptrace`, seccomp,
cross-process memory access, and memory locking. Failure is fail-safe: if a
probe cannot load, polling continues.
### Integrity and Tamper-Evidence