luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add event-driven memory syscall telemetry

Browse source
This commit is contained in:
Luna 2026-06-13 05:45:30 -07:00
parent 893409b549
commit a51478fa22
18 changed files with 589 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

8
enodia_sentinel/events/__init__.py
View file

@ -2,8 +2,8 @@
"""Event-driven detection layer.
Where the poll-based detectors sweep system state every few seconds, this layer
reacts to kernel events the instant they happen — so a process that executes and
exits between two sweeps (fileless droppers, short-lived reverse shells) is still
caught. Events come from eBPF (``bcc``) and are matched against a declarative,
Snort-style rule set.
reacts to kernel events the instant they happen — so a process that executes,
decrypts memory, changes page protections, or exits between two sweeps is still
caught. Events come from eBPF (``bcc``) and are matched against declarative,
Snort-style rule sets.
"""