Add host correlation and assurance coverage

README.md

@@ -26,9 +26,9 @@ behind reviewed response workflows rather than silent remediation.
 
 | Function | Current capability | Direction |
 |---|---|---|
-| Detect | Poll detectors + eBPF exec/syscall rules + typed host-event fixtures | More live event sources and correlation |
+| Detect | Poll detectors + eBPF exec/syscall/host-event rules, first-seen rarity, and incident correlation | More live event sources and correlation rules |
 | Prevent | Posture checks + dry-run containment plans | Audited, explicit `--apply` workflows |
-| Verify | FIM, package DB anchor, signed-package checks | External anchors and signed evidence |
+| Verify | FIM, package DB anchor, signed-package checks, local hash-chain records | External anchors and signed evidence |
 | Investigate | Text/JSON snapshots, incidents, dashboard, triage | Richer timelines and evidence export |
 | Respond | Persisted dry-run response plans | Audited containment and recovery execution |
 | Assure | Heartbeat, watchdog, self-integrity, rootcheck | Fleet health and attestation-ready anchors |
@@ -46,11 +46,14 @@ Project docs:
 - [Packaging guide](docs/PACKAGING.md) — Arch package layout plus Debian/RPM
   source-install paths.
 - [JSON schemas](docs/SCHEMAS.md) — stable v1 contracts for alerts, incidents,
-  status, response plans, response audit records, and reconciliation acks.
+  status, integrity/hash-chain state, response plans, response audit records,
+  and reconciliation acks.
 - [IR runbooks](docs/RUNBOOKS.md) — confirm/preserve/contain/recover playbooks
   per alert: reverse shells, persistence, trojaned binaries, rootkits, tampering.
 - [Rule reference](docs/RULES.md) — generated event-rule documentation: SID,
   signature, classtype, match fields, expected false positives, and drills.
+- [Fleet collector design](docs/FLEET_DESIGN.md) — optional v1.2 collector
+  boundaries for small multi-host deployments.
 
 > **Two implementations, on purpose.** The project began as a bash prototype
 > (`src/sentinel.sh`, kept as the regression **oracle**) and was re-architected
@@ -74,12 +77,15 @@ EDRs are built on:
 | `stealth_network` | Raw, SCTP, DCCP, packet, MPTCP, TIPC, XDP, or vsock activity | Covert channels often avoid ordinary TCP/UDP paths; expected network managers/sniffers are tunable |
 | `memory_obfuscation` | Executable anonymous/memfd/deleted mappings, RWX pages, mapped process-hiding libraries, or executable `.so` mappings from writable runtime paths | Encrypted/packed payloads still need executable memory after decrypting; hide/injection libraries must be mapped to hook tools |
 | `new_listener` | A listening port absent from the startup baseline | Bind shells/backdoors have to listen somewhere |
+| `first_public_destination` / `first_listener_port` | New per-process network destinations and listening ports after the initial rarity baseline | C2 and backdoors often introduce network edges that were not normal for that process name |
 | `new_suid` | A new SUID/SGID binary (critical in a writable dir) | A SUID `/tmp` binary is a textbook privesc trick |
 | `persistence` | Changes to cron, systemd units, `authorized_keys`, rc files | Persistence has to write somewhere that survives reboot |
 | `egress` | An interpreter with an established connection to a public IP | C2 beacons and exfil have to phone home |
 
 Every detection carries a stable **`sid`** and a **`classtype`** (à la
 Snort/Suricata), so it can be referenced, tuned, and tracked across revisions.
+Incident correlation adds higher-confidence SIDs, such as multi-stage web-RCE
+behavior, without hiding the underlying raw alerts.
 
 ## Event-driven detection (eBPF + a Snort-style rule engine)