diff --git a/CLAUDE.md b/CLAUDE.md index 7cd1ada..12bb195 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -24,18 +24,23 @@ Primary functions: ## Current State Snapshot -As of 2026-07-04, the project is a local-first Linux IDS/IPS/EDR agent at +As of 2026-07-24, the project is a local-first Linux IDS/IPS/EDR agent at package version `0.7.0`. The branch has a working stdlib-only daemon, CLI, HTTPS management console, incident model, response planner, rootcheck, posture checks, file/package integrity checks, push notification backends, and optional bcc/eBPF telemetry. -An experimental, non-installing Phase 1 Go sidecar now lives under `go-agent/`. -It is stdlib-only, emits `enodia.event.v1` JSONL, captures an injectable process -file-descriptor, and socket view, and currently ports `reverse_shell`, -`ld_preload`, `deleted_exe`, `input_snooper`, `credential_access`, -`stealth_network`, and `egress`. Python remains the production agent and parity -oracle; do not describe the Go path as a replacement yet. +An experimental, non-installing Go sidecar now lives under `go-agent/`. It is +stdlib-only, emits `enodia.event.v1` JSONL, and ports all current Python poll +detectors, the exec/syscall/typed-host rule engines, opt-in `cilium/ebpf` exec +and syscall sources, hot-path plus asynchronous enrichment, and Python-schema- +compatible incidents/snapshots/hash-chain. A `--state-dir`-gated set of +sidecar-only integrity engines (FIM, package-DB anchor, rootcheck) now also +runs asynchronously off the sweep loop. Python's dashboard has an opt-in, +explicitly read-only `/api/go-sidecar/*` consumer (`go_sidecar_state_dir`, the +Sidecar tab) that displays this evidence without starting, stopping, or +otherwise controlling the Go process. Python remains the production agent and +parity oracle; do not describe the Go path as a replacement yet. Implemented detection coverage: @@ -63,9 +68,13 @@ Implemented investigation/response state: - The dashboard is HTTPS-only, token-protected off loopback, and read-only. It shows status, incidents, timelines, alerts, posture findings, integrity/watchdog state, event-rule metadata, event tail, dry-run response - plans, and a local Settings menu with persistent themes. Web tests cover the - theme registry, integrity console wiring, and core text/status contrast - checks. + plans, and a local Settings menu with persistent themes. An opt-in Sidecar + tab additionally displays the isolated Go migration-sidecar's retained + heartbeat, alerts, incidents, and event log when `go_sidecar_state_dir` is + configured; this consumer is schema-checked and read-only, and never starts, + stops, or controls the Go process. Web tests cover the theme registry, + integrity console wiring, sidecar consumer isolation, and core text/status + contrast checks. - `respond plan ` builds read-only containment/recovery plans, persists CLI-generated plans under `response-plans/`, and appends `response-audit.log`. Dashboard/API plan previews do not write artifacts. @@ -164,9 +173,11 @@ Start with: GUI-free presentation model over `tui.collect_model`; only `gui/app.py` (tkinter) and `gui/qt_app.py` (PySide6, `[qt]` extra) import GUI libraries, enforced by import-guard tests. -- `go-agent/` is the isolated Phase 1 sidecar with Go config, process-state, - detector, schema, and sweep-loop packages. It writes JSONL to stdout and - must not share or mutate Python daemon state during parity development. +- `go-agent/` is the isolated sidecar with Go config, process-state, detector, + schema, and sweep-loop packages, plus `fim/`, `pkgdb/`, and `rootcheck/` + sidecar-only integrity engines. It writes JSONL to stdout (or a private + retained tree under `--state-dir`) and must not share or mutate Python + daemon state during parity development. ## Current Threat Mapping diff --git a/README.md b/README.md index 6a569ef..3af594d 100644 --- a/README.md +++ b/README.md @@ -430,6 +430,10 @@ sudo systemctl enable --now enodia-sentinel-web API at `/api/status`, `/api/incidents`, `/api/respond/plan/`, `/api/posture`, `/api/integrity`, `/api/rules`, `/api/alerts`, `/api/alerts/`, `/api/events`. +- **Optional Go migration evidence**: set `go_sidecar_state_dir` to the + sidecar's separate state directory to expose retained heartbeat, snapshots, + incidents, and JSONL through `/api/go-sidecar/*`. These endpoints are + read-only and never replace Python dashboard data or control the sidecar. - **Operator settings**: the self-contained dashboard includes a Settings menu with persistent local themes: Console, Paper, Contrast, LGBTQ, Trans, Dracula, Solarized Dark, Solarized Light, and Twilight. Static dashboard tests guard diff --git a/config/enodia-sentinel.toml b/config/enodia-sentinel.toml index 26d5b60..df5132e 100644 --- a/config/enodia-sentinel.toml +++ b/config/enodia-sentinel.toml @@ -214,3 +214,6 @@ web_token = "" # bearer token; auto-generated + saved if empty on a # point these at your own local/private CA certificate. web_tls_cert = "" web_tls_key = "" +# Optional: expose a separately retained Go validation-sidecar state tree via +# read-only /api/go-sidecar/* endpoints. Never point this at the Python log_dir. +go_sidecar_state_dir = "" diff --git a/docs/COMMAND_REFERENCE.md b/docs/COMMAND_REFERENCE.md index fea0af7..91c7e33 100644 --- a/docs/COMMAND_REFERENCE.md +++ b/docs/COMMAND_REFERENCE.md @@ -471,6 +471,12 @@ HTTPS is mandatory. If `web_tls_cert` / `web_tls_key` are not configured, Sentinel creates a self-signed pair under `log_dir`; add a browser exception for that certificate or replace it with a private/local CA certificate. +When `go_sidecar_state_dir` is explicitly configured, the same authenticated +read-only server also exposes the isolated migration-sidecar evidence at +`/api/go-sidecar/status`, `/api/go-sidecar/alerts`, `/api/go-sidecar/events`, +and `/api/go-sidecar/incidents`. These paths never start, stop, or alter the Go +sidecar, and do not replace the Python daemon's normal API data. + The console exposes incidents, alert snapshots, posture findings, integrity/watchdog state, event-rule metadata, event tail, and dry-run response plans. It remains read-only; response commands are displayed for review but not diff --git a/docs/GO_PORT_HANDOFF.md b/docs/GO_PORT_HANDOFF.md index a6b7b19..7875c65 100644 --- a/docs/GO_PORT_HANDOFF.md +++ b/docs/GO_PORT_HANDOFF.md @@ -1,9 +1,15 @@ # Go Port Handoff Saved: 2026-07-22T04:08:40-07:00 +Updated: 2026-07-24T04:45:55-07:00 Branch: `main` -Base commit: `a25c73a` (`feat(go): report integrity anchor context`) -Status: current Go-port state saved in this checkpoint; separate GUI work remains uncommitted +Base commit: `a25c73a` (`feat(go): report integrity anchor context`); the FIM/ +package-DB/rootcheck engines and the Python go-sidecar dashboard consumer +described below landed on top of that commit and remain uncommitted. +Status: items 1 and 2 of "Resume here" are now implemented and green; see the +updated sections below. Desktop GUI work referenced by the original checkpoint +has since been committed (`457c760`, `1d1dee7`, and related commits) and is no +longer part of this checkout's uncommitted state. ## Worktree warning @@ -14,10 +20,12 @@ continuations. Do not reset, clean, or broadly restage it. assurance, asynchronous-enrichment, incident-reader, package-ownership, and integrity-anchor tranches are signed commits `f85c2e8`, `538d1d9`, `fd2bbba`, `1ab4add`, `eff31b3`, `6355fb4`, `88d7a6e`, and `a25c73a`. -- At this checkpoint, `git status --short` has 11 entries with untracked - directories collapsed. -- The Python GUI files and tests are separate pre-existing work. Preserve them - while continuing the Go port. +- On top of that, uncommitted work now adds `go-agent/internal/{fim,pkgdb, + rootcheck}/`, wires them into `agent.Sweep`/`Initialize` behind + `--state-dir`, and adds Python's read-only `/api/go-sidecar/*` consumer + (`enodia_sentinel/web.py`, `schemas.GO_SIDECAR_V1`) plus a Sidecar dashboard + tab. `git status --short` currently shows this as modified files across both + trees plus the three new untracked Go package directories. - `build/` is ignored and contains only local build output. ## Implemented Go surface @@ -106,15 +114,46 @@ static binary. - The asynchronous worker now resolves pacman/dpkg/rpm package-owner strings with a two-second bound and cache; ownership lookup never holds a detector lock or blocks alert capture. -- The worker now reports FIM-baseline, package-DB-anchor, and Go hash-chain - presence/age. It explicitly marks package verification and rootcheck disabled - until their actual engines are ported. -- Richer integrity engines and notification fan-out are not yet ported. +- The worker reports FIM-baseline, package-DB-anchor, and Go hash-chain + presence/age, plus the configured `pacman -Qkk` and rootcheck cadences now + that those engines are ported (see below). This remains metadata only: + recording a snapshot never starts integrity work itself. +- Notification fan-out is not yet ported. - `--incidents-list` and `--incident-show ` now read the sidecar's isolated state without starting the agent. The latter returns `enodia.incident.view.v1` with the incident, available snapshots, and time-ordered timeline. - No live system service was installed or enabled during development. +### FIM, package-DB anchor, and rootcheck engines (new since the base commit) + +- `go-agent/internal/fim` is a sidecar-only engine, gated on `--state-dir`, + that persists a SHA-256 security-path baseline as `fim-baseline.json` and + performs non-overlapping background comparisons on `fim_scan_interval`, + emitting the Python-identical SIDs `100017`-`100019`. `fim_pkg_verify = true` + opts into a bounded `pacman -Qkk` verification pass emitting SID `100020`. +- `go-agent/internal/pkgdb` fingerprints pacman's local checksum database on + `pkgdb_interval` and alerts (SID `100021`) only on changes lacking a + corresponding transaction-log record; it never refreshes an unexplained + changed anchor. +- `go-agent/internal/rootcheck` bounds PID cross-view probing with + `rootcheck_pid_cap`, runs one background comparison per + `rootcheck_interval`, and reproduces the Python rootcheck SIDs (hidden + process/module/port families, promiscuous mode, module/kernel taint) from + procfs, sysfs, `ps`, and socket views. +- All three run asynchronously off the sweep loop (`agent.Sweep` calls + `MaybeStart` before detector evaluation and `Drain` after, so a slow hash + tree or `pacman` invocation never delays a sweep) and return alerts through + the existing cooldown/snapshot/incident pipeline rather than emitting + directly. +- `enodia_sentinel/web.py` adds a read-only, schema-checked consumer for this + evidence: `go_sidecar_state_dir` (config key) exposes `/api/go-sidecar/ + {status,alerts,incidents,events}` and a dashboard Sidecar tab. It never + starts, stops, or writes into the Go sidecar's state directory, and a + corrupted retained event log fails the request closed rather than showing a + partial stream. The new `enodia.go.sidecar.v1` schema lives in + `enodia_sentinel/schemas.py` and is pinned by + `tests/test_schema_contracts.py::test_go_sidecar_v1_contract`. + ## Last green verification Run from the repository root: @@ -132,7 +171,7 @@ make check-go-service git diff --check ``` -Results at save time: +Results at original save time (`a25c73a`): - Python: 377 tests passed. - Go unit and race suites: all packages passed through `a25c73a`. @@ -152,19 +191,44 @@ Results at save time: startup/quiet-period retention, process context, and Python dashboard-reader compatibility. +Results re-verified 2026-07-24 with the FIM/pkgdb/rootcheck engines and +go-sidecar dashboard consumer added on top: + +- Python: 385 tests passed (`unittest discover`). +- Go unit and `-race` suites: all packages passed, including the new `fim`, + `pkgdb`, and `rootcheck` packages. +- `go vet` and `go mod verify`: passed. +- Parity counts are unchanged from the original checkpoint (22/5/7/10/22/3/2), + as expected: the new engines are integrity checks outside the poll/exec/ + syscall/host-rule parity fixture. +- `systemd-analyze verify` and the three Go sidecar packaging/isolation tests: + passed. +- `git diff --check`: passed (no whitespace errors). +- Static cross-arch builds were not re-run this pass. + The Python suite prints three expected CLI error lines from negative tests and one existing `ResourceWarning` for an implicitly cleaned-up HTTP 401 object; the suite still exits successfully. ## Resume here -1. Port the actual FIM/package-verification/rootcheck engines behind explicit, - bounded acceptance gates; do not treat enrichment anchor status as detection - parity. -2. Add a read-only management API consumer for isolated Go snapshot/event state - while keeping Python authoritative. +1. ~~Port the actual FIM/package-verification/rootcheck engines behind + explicit, bounded acceptance gates~~ — done: `go-agent/internal/{fim,pkgdb, + rootcheck}`, gated on `--state-dir`, tested, and wired into `agent.Sweep`. +2. ~~Add a read-only management API consumer for isolated Go snapshot/event + state while keeping Python authoritative~~ — done: `/api/go-sidecar/*` in + `enodia_sentinel/web.py` plus the dashboard Sidecar tab, schema-checked and + never controlling the Go process. 3. Continue broader Phase 3 rule metadata/state parity before considering any - default-service or package cutover. + default-service or package cutover. This is the remaining item from the + original checkpoint. +4. Notification fan-out for the Go sidecar (item noted above) is still + unported; the FIM/pkgdb/rootcheck engines currently return alerts only + through the shared JSONL/snapshot/incident pipeline, not push backends. +5. Consider whether `04-integrity.md` and `05-rootcheck.md` in + `docs/behavior/` (currently "planned") should be written now that these + engines exist on both sides, so future Go-side changes have the same + reviewable behavioral contract as the poll detectors and event rules do. Keep the validation sidecar opt-in, preserve its separate state tree, and keep new attack/event primitives disconnected from destructive response paths. diff --git a/docs/OPERATIONS.md b/docs/OPERATIONS.md index 5c35139..a2382be 100644 --- a/docs/OPERATIONS.md +++ b/docs/OPERATIONS.md @@ -75,7 +75,10 @@ Expected healthy output: The HTTPS dashboard shows the same posture findings under the Posture tab and summarizes FIM/package anchors plus heartbeat freshness under the Integrity tab -for quick remote review. +for quick remote review. If the optional `go_sidecar_state_dir` setting points +at an isolated Go migration-sidecar state directory, a Sidecar tab also shows +that sidecar's own retained heartbeat, alert snapshots, incidents, and event +log, read-only and clearly separate from Python's production data. For SSH/tmux operators, `enodia-sentinel tui` provides a terminal dashboard over the same local read-only management state: status, recent alerts, incidents, diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md index 18d3e23..8bffacd 100644 --- a/docs/ROADMAP.md +++ b/docs/ROADMAP.md @@ -300,9 +300,23 @@ Exit criteria: now provide truthful retained counts and basic process context. A private, atomic `enodia.incident.v1` index now applies the shared lineage-first/time- window grouping, assigns real snapshot `incident_id` values, and persists - correlation SID `100080`. The Python service remains the production default - until rich enrichment/assurance, management-console consumers, and broader - subsystem parity land. + correlation SID `100080`. Hot-path enrichment adds bounded process/parent + context, lineage, remote-IP classification, and candidate paths synchronously, + while a 16-job asynchronous worker adds streamed executable hashes, file + metadata, and package-owner strings under a query bound. The sidecar now also + has sidecar-only, `--state-dir`-gated FIM (`fim-baseline.json`, SIDs + `100017`–`100020`, optional `pacman -Qkk` verification), package-DB anchor + (`pkgdb_verify`, SID `100021`), and rootcheck (procfs/sysfs/`ps`/socket/ + module-taint/kernel-taint/promiscuous-mode cross-view checks) engines that + run asynchronously off the sweep loop and return alerts through the same + cooldown/snapshot/incident pipeline. Python's dashboard gained a first, + explicitly read-only management-console consumer for this migration + evidence: an opt-in `go_sidecar_state_dir` setting exposes `/api/go-sidecar/*` + endpoints and a Sidecar dashboard tab that display the Go sidecar's retained + heartbeat, alert snapshots, incidents, and event log without starting, + stopping, or otherwise controlling the Go process. The Python service remains + the production default until notification fan-out and broader subsystem + parity land. ## Backlog diff --git a/docs/SCHEMAS.md b/docs/SCHEMAS.md index 075afb3..52c1056 100644 --- a/docs/SCHEMAS.md +++ b/docs/SCHEMAS.md @@ -139,6 +139,33 @@ Required fields: | `hash_chain` | object | Local append-only hash-chain summary for snapshots and event logs: path, exists flag, record count, and last chain hash. | | `read_only` | boolean | Always true for this dashboard API. | +## `enodia.go.sidecar.v1` + +Status object returned by `/api/go-sidecar/status`, describing the optional, +separately configured Go migration-sidecar evidence tree (`go_sidecar_state_dir`). +This is a read-only view of another process's retained files: the Python web +process never starts, stops, or probes the Go sidecar, and this schema does not +appear anywhere in the production Python daemon's own state. + +Required fields: + +| Field | Type | Meaning | +|---|---|---| +| `schema` | string | `enodia.go.sidecar.v1`. | +| `read_only` | boolean | Always true. | +| `configured` | boolean | Whether `go_sidecar_state_dir` is set. | +| `state_dir` | string | The configured path, or `""` if unset. | +| `available` | boolean | Whether the configured directory currently exists. | +| `heartbeat` | object | `{"status": "not-configured"\|"missing"\|"fresh"\|"stale", ...}`; `fresh`/`stale` reports also include `timestamp`, `age_seconds`, and `max_age_seconds`. | + +The related `/api/go-sidecar/alerts`, `/api/go-sidecar/incidents`, and +`/api/go-sidecar/events` endpoints replay the Go sidecar's own +`enodia.alert.snapshot.v1`, `enodia.incident.v1`, and `enodia.event.v1` records +after schema-checking each one; malformed or unrecognized files are dropped +(alerts/incidents) or reported as an explicit error rather than partially +displayed (events), so a damaged retained file cannot be misread as a clean +evidence stream. + ## `enodia.hash_chain.v1` JSONL record appended to `hash-chain.jsonl` when Sentinel captures forensic diff --git a/docs/SURICATA_ASSIMILATION.md b/docs/SURICATA_ASSIMILATION.md index 78757da..361ef43 100644 --- a/docs/SURICATA_ASSIMILATION.md +++ b/docs/SURICATA_ASSIMILATION.md @@ -251,9 +251,13 @@ signature keeps `sid` / `signature` / `classtype` / tests / docs. transports. Bounded `enodia.alert.snapshot.v1` JSON/text pairs now retain alerts with basic process context and feed truthful status counts. An atomic `enodia.incident.v1` index supplies lineage/time grouping, snapshot IDs, and - correlation evidence. Rich enrichment/assurance, management-consumer - integration, and broader parity must land before the bcc/Python runtime - dependency can be dropped. + correlation evidence. Hot-path plus asynchronous enrichment (hashes, file + metadata, package ownership) now populate snapshots, and sidecar-only, + `--state-dir`-gated FIM, package-DB-anchor, and rootcheck integrity engines + now run asynchronously off the sweep loop. Python's dashboard has a first + read-only management-console consumer (`go_sidecar_state_dir`, + `/api/go-sidecar/*`) over this isolated evidence. Broader Phase 3 rule-engine + parity must land before the bcc/Python runtime dependency can be dropped. - **Phase 3 — Rule-engine parity + assimilation.** `rev`/`reference`/`metadata`, statebits (flowbits), thresholding, suppression, and — if rule count warrants — the MPM prefilter. `rules list/show/test/docs` parity. diff --git a/docs/THREAT_MODEL.md b/docs/THREAT_MODEL.md index fa908ee..9beea0e 100644 --- a/docs/THREAT_MODEL.md +++ b/docs/THREAT_MODEL.md @@ -55,6 +55,26 @@ The default service is hardened and read-mostly. Enabling the bcc eBPF monitor requires additional capabilities and memory permissions. That tradeoff is explicit: stronger event visibility for a wider runtime permission set. +### Go Migration-Sidecar Evidence Is Isolated and Read-Only + +The experimental `go-agent/` sidecar (see `docs/ROADMAP.md`'s Active Migration +Track) is a separate process with its own state directory, baselines, FIM/ +package-DB/rootcheck engines, and hash-chain. It never shares or mutates the +Python daemon's `log_dir`, baselines, or anchors, and it is not the production +agent. + +When an operator opts in with `go_sidecar_state_dir`, the Python dashboard adds +a read-only consumer (`/api/go-sidecar/*`, the Sidecar tab) over that directory. +It treats the Go sidecar's retained files as untrusted input from another +process rather than trusted application state: every alert snapshot and +incident record is schema-checked before display, a corrupted retained event +log fails the request closed instead of showing a partial stream, and the web +process never starts, stops, signals, or writes into the Go sidecar's state +directory. Compromising this consumer therefore requires tampering with the Go +sidecar's own retained files, which is the same class of local-tampering +problem `enodia.hash_chain.v1` and the sidecar's own FIM self-watch already +cover. + ## Detection Assumptions Sentinel assumes: diff --git a/enodia_sentinel/config.py b/enodia_sentinel/config.py index 9c525f6..7dc3a35 100644 --- a/enodia_sentinel/config.py +++ b/enodia_sentinel/config.py @@ -173,6 +173,11 @@ class Config: web_token: str = "" # bearer token; auto-generated if empty + non-local web_tls_cert: str = "" # "" = auto-generate self-signed cert under log_dir web_tls_key: str = "" # "" = auto-generate private key under log_dir + # Optional, read-only Go validation-sidecar evidence tree. This must stay + # separate from log_dir so the Python daemon remains the production source + # of truth and the dashboard never mistakes migration evidence for Python + # alert state. + go_sidecar_state_dir: str = "" # paths log_dir: Path = Path("/var/log/enodia-sentinel") diff --git a/enodia_sentinel/ruleops.py b/enodia_sentinel/ruleops.py index c64696f..1e14383 100644 --- a/enodia_sentinel/ruleops.py +++ b/enodia_sentinel/ruleops.py @@ -58,6 +58,11 @@ def render_markdown(cfg: Config) -> str: "Use `enodia-sentinel rules list/show/test` to inspect rules and validate " "event fixtures locally.", "", + "Built-in event-rule fixtures live in `tests/fixtures/sids/` and can be replayed", + "with `enodia-sentinel rules test tests/fixtures/sids/-.json`.", + "Non-event built-in SIDs are covered by safe offline drills in `tests/sid_drills.py`;", + "`python3 -m unittest tests.test_sid_coverage -v` verifies the full registry.", + "", ] for rule in list_rules(cfg): doc = _RULE_DOCS.get(rule["sid"], {}) @@ -284,33 +289,61 @@ _RULE_DOCS: dict[int, dict[str, Any]] = { ], "drill": "Use `rules test` with a `listen` event whose `comm` is an interpreter and whose `local_port` is not a common service port.", }, + 100069: { + "false_positives": [ + "Installer, configuration-management, or recovery scripts that legitimately write persistence paths from an interpreter.", + "Administrative SSH-key or service-unit maintenance performed by a reviewed script.", + ], + "drill": "Use `rules test` with `tests/fixtures/sids/100069-interpreter-persistence-write.json`.", + }, + 100070: { + "false_positives": [ + "Package post-install scripts or configuration-management agents adjusting mode/owner on system service, sudoers, cron, or SSH key files.", + "Manual recovery work that repairs permissions after a known-good change.", + ], + "drill": "Use `rules test` with `tests/fixtures/sids/100070-persistence-permission-change.json`.", + }, + 100071: { + "false_positives": [ + "Reviewed administrative wrappers that intentionally run interpreters across a root UID transition.", + "Privileged installer or service-management scripts during maintenance windows.", + ], + "drill": "Use `rules test` with `tests/fixtures/sids/100071-interpreter-setuid-root.json`.", + }, + 100072: { + "false_positives": [ + "Reviewed administrative wrappers that intentionally run interpreters across a root GID transition.", + "Privileged installer or service-management scripts during maintenance windows.", + ], + "drill": "Use `rules test` with `tests/fixtures/sids/100072-interpreter-setgid-root.json`.", + }, 100073: { "false_positives": [ "Developer or diagnostic scripts binding high local ports intentionally.", "Short-lived local service wrappers that bind before handing sockets to a supervised process.", ], - "drill": "Use `rules test` with a `bind` event whose `comm` is an interpreter and whose `local_port` is not a common service port.", + "drill": "Use `rules test` with `tests/fixtures/sids/100073-interpreter-unusual-bind.json`.", }, 100076: { "false_positives": [ "Developer servers or test harnesses accepting inbound public traffic from an interpreter.", "Administrative troubleshooting with temporary netcat/socat listeners.", ], - "drill": "Use `rules test` with an `accept` event whose `comm` is an interpreter, public `peer_ip`, and unusual `local_port`.", + "drill": "Use `rules test` with `tests/fixtures/sids/100076-interpreter-unusual-accept.json`.", }, 100077: { "false_positives": [ "Privileged maintenance scripts that intentionally adjust capabilities during controlled administration.", "Container or network lab setup scripts using interpreters to configure namespaces or packet capture.", ], - "drill": "Use `rules test` with a `capset` event containing a sensitive capability such as `CAP_SYS_ADMIN`.", + "drill": "Use `rules test` with `tests/fixtures/sids/100077-interpreter-capset-sensitive.json`.", }, 100078: { "false_positives": [ "Kernel development labs loading locally built modules from temporary build directories.", "Driver troubleshooting sessions that intentionally test an unsigned module from a writable path.", ], - "drill": "Use `rules test` with a `module_load` event whose `path` is under `/tmp`, `/var/tmp`, `/dev/shm`, or `/run/user`.", + "drill": "Use `rules test` with `tests/fixtures/sids/100078-module-load-writable-path.json`.", }, } diff --git a/enodia_sentinel/schemas.py b/enodia_sentinel/schemas.py index eadde08..f184f57 100644 --- a/enodia_sentinel/schemas.py +++ b/enodia_sentinel/schemas.py @@ -19,3 +19,4 @@ RESPONSE_PLAN_V1 = "enodia.response.plan.v1" RESPONSE_AUDIT_V1 = "enodia.response.audit.v1" RECONCILE_V1 = "enodia.reconcile.v1" EVENT_V1 = "enodia.event.v1" +GO_SIDECAR_V1 = "enodia.go.sidecar.v1" diff --git a/enodia_sentinel/static/dashboard.html b/enodia_sentinel/static/dashboard.html index b6bcacc..bc27070 100644 --- a/enodia_sentinel/static/dashboard.html +++ b/enodia_sentinel/static/dashboard.html @@ -313,6 +313,7 @@ + @@ -320,6 +321,7 @@ + @@ -333,7 +335,7 @@