luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add host correlation and assurance coverage

Browse source
This commit is contained in:
Luna 2026-07-10 03:07:00 -07:00
parent 8194d13734
commit b40ac4252c
No known key found for this signature in database
36 changed files with 944 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

45
tests/sid_drills.py
View file

@ -8,13 +8,14 @@ from collections.abc import Callable
from dataclasses import dataclass, field
from pathlib import Path
from enodia_sentinel import fim, pkgdb, posture, rootcheck
from enodia_sentinel.alert import Alert
from enodia_sentinel import correlation, fim, pkgdb, posture, rootcheck
from enodia_sentinel.alert import Alert, Severity
from enodia_sentinel.config import Config
from enodia_sentinel.detectors import (
credential_access,
deleted_exe,
egress,
first_seen,
input_snooper,
ld_preload,
memory_obfuscation,
@ -131,6 +132,43 @@ def _pkgverify() -> list[Alert]:
pkgdb.siglevel_alert = saved
def _first_seen_public_destination() -> list[Alert]:
with tempfile.TemporaryDirectory() as d:
cfg = _cfg()
cfg.log_dir = Path(d)
list(first_seen.detect(SystemState(sockets=[
Socket("ESTAB", "10.0.0.2:5000", "8.8.8.8:443", 1, "curl", 400, "tcp"),
]), cfg))
return list(first_seen.detect(SystemState(sockets=[
Socket("ESTAB", "10.0.0.2:5001", "1.1.1.1:8443", 2, "curl", 400, "tcp"),
]), cfg))
def _first_seen_listener_port() -> list[Alert]:
with tempfile.TemporaryDirectory() as d:
cfg = _cfg()
cfg.log_dir = Path(d)
list(first_seen.detect(SystemState(sockets=[
Socket("LISTEN", "0.0.0.0:8000", "*:*", 1, "python3", 401, "tcp"),
]), cfg))
return list(first_seen.detect(SystemState(sockets=[
Socket("LISTEN", "0.0.0.0:9000", "*:*", 2, "python3", 401, "tcp"),
]), cfg))
def _correlation_alert() -> list[Alert]:
inc = {
"first_ts": 1000.0,
"last_ts": 1050.0,
"signatures": ["exec_rule.web-rce", "host_rule.suspicious-egress"],
}
return [
Alert(Severity.CRITICAL, c["signature"], f"corr:{c['sid']}",
c["summary"], sid=c["sid"], classtype=c["classtype"])
for c in correlation.correlate(inc)
]
def _fim_pkg() -> list[Alert]:
saved = fim.pacman_verify
fim.pacman_verify = lambda timeout=600: [
@ -321,4 +359,7 @@ DRILLS: dict[int, Callable[[], list[Alert]]] = {
posture.UnitFact("evil.service", "/etc/systemd/system/evil.service",
0o100644, True, ("/tmp/payload",)),
])),
100074: _first_seen_public_destination,
100075: _first_seen_listener_port,
100080: _correlation_alert,
}