luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(go): port socket detectors

Browse source
This commit is contained in:
Luna 2026-07-10 17:29:07 -07:00
parent fc9b5f0448
commit c6f7219de8
23 changed files with 693 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

6
go-agent/README.md
View file

@ -7,11 +7,13 @@ behavioral oracle until every subsystem reaches fixture and red-team parity.
Current scope:
- standard-library-only flat TOML loading for the settings used so far;
- an injectable `/proc` process snapshot boundary;
- an injectable `/proc` process/file-descriptor snapshot plus fail-open `ss`
socket collection;
- a cancellable sweep loop that emits JSONL `enodia.event.v1` records;
- exact `enodia.alert.v1` parity for `ld_preload` (SID `100011`),
`deleted_exe` (`100012`), `input_snooper` (`100032`), and
`credential_access` (`100033`);
`credential_access` (`100033`), plus `reverse_shell` (`100010`), `egress`
(`100016`), and `stealth_network` (`100036`);
- `enodia.status.v1` heartbeat records with no persistence or retained-alert
claims;
- a shared fixture checked against the Python detector by