luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add event-driven memory syscall telemetry

Browse source
This commit is contained in:
Luna 2026-06-13 05:45:30 -07:00
parent 893409b549
commit a51478fa22
18 changed files with 589 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

7
enodia_sentinel/config.py
View file

@ -136,9 +136,12 @@ class Config:
# eBPF on-ramp
capture_execve_bpftrace: bool = False
# Event-driven eBPF execve monitor (catches short-lived processes the poll
# loop misses). Degrades gracefully to polling if bcc/root/BTF unavailable.
# Event-driven eBPF monitors (catch short-lived activity the poll loop
# misses). Degrade gracefully to polling if bcc/root/BTF unavailable.
ebpf_exec_monitor: bool = True
# Event-driven syscall telemetry for short-lived memory/anti-analysis
# behavior: memfd_create, mmap/mprotect RWX, ptrace, seccomp, process_vm_*.
ebpf_syscall_monitor: bool = True
exec_rules_file: str = "" # optional extra Snort-style rules (TOML)
# retention