luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(go): port FIM/pkgdb/rootcheck integrity engines and add go-sidecar dashboard consumer

Browse source 
Adds sidecar-only, --state-dir-gated FIM, package-DB-anchor, and rootcheck
engines to the Go migration sidecar, wired into agent.Sweep/Initialize
behind the existing baseline lifecycle. Adds a read-only, schema-checked
Python dashboard consumer (go_sidecar_state_dir, /api/go-sidecar/*, Sidecar
tab) that never starts, stops, or mutates the Go sidecar's state.

Also fixes drift found while reconciling this work: enodia_sentinel/web.py
had reinvented local schema constants instead of using the canonical
enodia_sentinel/schemas.py catalog (now registers enodia.go.sidecar.v1
there and reuses ALERT_SNAPSHOT_V1/INCIDENT_V1); docs/RULES.md had drifted
from what `rules docs` actually generates for SIDs 100069-100078 (ruleops.py
was missing metadata for four SIDs and had stale drill text for four more),
now back in sync with a regression test pinning them together.

Updates CLAUDE.md, README.md, go-agent/README.md, and docs/{ROADMAP,
GO_PORT_HANDOFF,SURICATA_ASSIMILATION,THREAT_MODEL,OPERATIONS,SCHEMAS,
COMMAND_REFERENCE}.md to reflect the landed work.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NQivSKBqQJsayz1xcYqWzZ
This commit is contained in:
Luna 2026-07-24 09:59:09 -07:00
parent 1d1dee7f6e
commit d835386381
No known key found for this signature in database
43 changed files with 3419 additions and 72 deletions
Download patch file Download diff file Expand all files Collapse all files

41
enodia_sentinel/ruleops.py
View file

@ -58,6 +58,11 @@ def render_markdown(cfg: Config) -> str:
"Use `enodia-sentinel rules list/show/test` to inspect rules and validate "
"event fixtures locally.",
"",
"Built-in event-rule fixtures live in `tests/fixtures/sids/` and can be replayed",
"with `enodia-sentinel rules test tests/fixtures/sids/<sid>-<slug>.json`.",
"Non-event built-in SIDs are covered by safe offline drills in `tests/sid_drills.py`;",
"`python3 -m unittest tests.test_sid_coverage -v` verifies the full registry.",
"",
]
for rule in list_rules(cfg):
doc = _RULE_DOCS.get(rule["sid"], {})
@ -284,33 +289,61 @@ _RULE_DOCS: dict[int, dict[str, Any]] = {
],
"drill": "Use `rules test` with a `listen` event whose `comm` is an interpreter and whose `local_port` is not a common service port.",
},
100069: {
"false_positives": [
"Installer, configuration-management, or recovery scripts that legitimately write persistence paths from an interpreter.",
"Administrative SSH-key or service-unit maintenance performed by a reviewed script.",
],
"drill": "Use `rules test` with `tests/fixtures/sids/100069-interpreter-persistence-write.json`.",
},
100070: {
"false_positives": [
"Package post-install scripts or configuration-management agents adjusting mode/owner on system service, sudoers, cron, or SSH key files.",
"Manual recovery work that repairs permissions after a known-good change.",
],
"drill": "Use `rules test` with `tests/fixtures/sids/100070-persistence-permission-change.json`.",
},
100071: {
"false_positives": [
"Reviewed administrative wrappers that intentionally run interpreters across a root UID transition.",
"Privileged installer or service-management scripts during maintenance windows.",
],
"drill": "Use `rules test` with `tests/fixtures/sids/100071-interpreter-setuid-root.json`.",
},
100072: {
"false_positives": [
"Reviewed administrative wrappers that intentionally run interpreters across a root GID transition.",
"Privileged installer or service-management scripts during maintenance windows.",
],
"drill": "Use `rules test` with `tests/fixtures/sids/100072-interpreter-setgid-root.json`.",
},
100073: {
"false_positives": [
"Developer or diagnostic scripts binding high local ports intentionally.",
"Short-lived local service wrappers that bind before handing sockets to a supervised process.",
],
"drill": "Use `rules test` with a `bind` event whose `comm` is an interpreter and whose `local_port` is not a common service port.",
"drill": "Use `rules test` with `tests/fixtures/sids/100073-interpreter-unusual-bind.json`.",
},
100076: {
"false_positives": [
"Developer servers or test harnesses accepting inbound public traffic from an interpreter.",
"Administrative troubleshooting with temporary netcat/socat listeners.",
],
"drill": "Use `rules test` with an `accept` event whose `comm` is an interpreter, public `peer_ip`, and unusual `local_port`.",
"drill": "Use `rules test` with `tests/fixtures/sids/100076-interpreter-unusual-accept.json`.",
},
100077: {
"false_positives": [
"Privileged maintenance scripts that intentionally adjust capabilities during controlled administration.",
"Container or network lab setup scripts using interpreters to configure namespaces or packet capture.",
],
"drill": "Use `rules test` with a `capset` event containing a sensitive capability such as `CAP_SYS_ADMIN`.",
"drill": "Use `rules test` with `tests/fixtures/sids/100077-interpreter-capset-sensitive.json`.",
},
100078: {
"false_positives": [
"Kernel development labs loading locally built modules from temporary build directories.",
"Driver troubleshooting sessions that intentionally test an unsigned module from a writable path.",
],
"drill": "Use `rules test` with a `module_load` event whose `path` is under `/tmp`, `/var/tmp`, `/dev/shm`, or `/run/user`.",
"drill": "Use `rules test` with `tests/fixtures/sids/100078-module-load-writable-path.json`.",
},
}