luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(go): port socket detectors

Browse source
This commit is contained in:
Luna 2026-07-10 17:29:07 -07:00
parent fc9b5f0448
commit c6f7219de8
23 changed files with 693 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

9
README.md
View file

@ -66,10 +66,11 @@ Project docs:
Phase 1 now also has an **experimental Go sidecar** under `go-agent/`. It emits
the same `enodia.event.v1` envelope and captures an injectable `/proc` process
view. The first parity-checked cohort is `ld_preload`, `deleted_exe`,
`input_snooper`, and `credential_access`. It is stdout-only and does not
replace, install over, or write state for the Python daemon; Python remains
authoritative until subsystem parity is complete.
and `ss` socket view. The parity-checked cohort is `reverse_shell`,
`ld_preload`, `deleted_exe`, `input_snooper`, `credential_access`,
`stealth_network`, and `egress`. It is stdout-only and does not replace,
install over, or write state for the Python daemon; Python remains authoritative
until subsystem parity is complete.
## Why these detectors