luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add host correlation and assurance coverage

Browse source
This commit is contained in:
Luna 2026-07-10 03:07:00 -07:00
parent 8194d13734
commit b40ac4252c
No known key found for this signature in database
36 changed files with 944 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

40
docs/SCHEMAS.md
View file

@ -66,6 +66,11 @@ Required fields:
| `lineage` | array | Process-lineage IDs used for grouping. |
| `snapshots` | array | Member snapshot filenames. |
| `alert_count` | integer | Total alerts grouped into the incident. |
| `correlations` | array | Higher-confidence correlation records derived from the incident's raw alerts. Empty when no correlation rule matched. |
Each correlation record is additive evidence on the incident and keeps the raw
alerts visible. Current fields are `sid`, `signature`, `classtype`, `severity`,
`summary`, `window_seconds`, and `matched_signatures`.
`incident show --json` returns `enodia.incident.view.v1` with `schema`,
`incident`, and `timeline`. The dashboard incident API returns the same schema
@ -108,8 +113,43 @@ Required fields:
| `watchdog` | object | Daemon running state, heartbeat age, stale flag, max age, and verdict message. |
| `anchors` | object | FIM baseline, package DB anchor, pacman keyring, and SigLevel summary. |
| `sentinel_footprint` | object | Configured Sentinel self-integrity paths and present/missing counts. |
| `hash_chain` | object | Local append-only hash-chain summary for snapshots and event logs: path, exists flag, record count, and last chain hash. |
| `read_only` | boolean | Always true for this dashboard API. |
## `enodia.hash_chain.v1`
JSONL record appended to `hash-chain.jsonl` when Sentinel captures forensic
artifacts. This is a local tamper-evidence chain; future fleet/external anchors
can mirror the same records off-box.
Required fields:
| Field | Type | Meaning |
|---|---|---|
| `schema` | string | `enodia.hash_chain.v1`. |
| `time` | number | Unix timestamp when the chain record was appended. |
| `kind` | string | Artifact kind, such as `snapshot-log`, `snapshot-json`, or `events-log`. |
| `path` | string | Local artifact path that was hashed. |
| `size` | integer | Artifact size in bytes, or `0` if unavailable. |
| `sha256` | string | SHA-256 of the artifact bytes, empty if unavailable. |
| `prev_hash` | string | Previous chain hash, empty for the first usable record. |
| `chain_hash` | string | SHA-256 over this record and `prev_hash`. |
## `enodia.first_seen.v1`
Local detector state stored in `first-seen.json`. The first detector pass builds
a baseline silently; later passes alert on new public destinations per process
name and new listener ports per process name.
Required fields:
| Field | Type | Meaning |
|---|---|---|
| `schema` | string | `enodia.first_seen.v1`. |
| `initialized` | boolean | Whether the initial silent baseline pass has completed. |
| `public_destinations` | object | Process name to sorted `host:port` destinations. |
| `listener_ports` | object | Process name to sorted listener port strings. |
## `enodia.response.plan.v1`
Dry-run response plan from `respond plan <incident-id>`.