luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(go): port socket detectors

Browse source
This commit is contained in:
Luna 2026-07-10 17:29:07 -07:00
parent fc9b5f0448
commit c6f7219de8
23 changed files with 693 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

12
go-agent/internal/agent/agent.go
View file

@ -57,6 +57,12 @@ func (a *Agent) Sweep() ([]map[string]any, error) {
timestamp := a.Now().Local().Format(time.RFC3339Nano)
alerts := make([]model.Alert, 0)
// Preserve the relative order of Python detectors.REGISTRY. Snapshot and
// parity consumers rely on stable alert ordering even while unported slots
// are temporarily absent from the Go implementation.
if a.Config.Enabled("reverse_shell") {
alerts = append(alerts, detectors.ReverseShell(state, a.Config)...)
}
if a.Config.Enabled("ld_preload") {
alerts = append(alerts, detectors.LDPreload(state)...)
}
@ -69,6 +75,12 @@ func (a *Agent) Sweep() ([]map[string]any, error) {
if a.Config.Enabled("credential_access") {
alerts = append(alerts, detectors.CredentialAccess(state, a.Config)...)
}
if a.Config.Enabled("stealth_network") {
alerts = append(alerts, detectors.StealthNetwork(state, a.Config)...)
}
if a.Config.Enabled("egress") {
alerts = append(alerts, detectors.Egress(state, a.Config)...)
}
events := make([]map[string]any, 0, len(alerts)+1)
for _, alert := range alerts {
record, err := schema.Build("alert", alert, host, timestamp)