Add status command (roadmap v0.8: status --json)

Add `enodia-sentinel status [--json]` — a local health and alert
summary: daemon running state, heartbeat freshness, per-severity alert
counts, last alert time, and eBPF state. Reuses web.daemon_status (the
same data behind /api/status), so the CLI and dashboard never diverge.

Exit code reflects health (0 = running and fresh, 1 = down or stale), so
it doubles as a cron/monitoring probe. Three CLI tests drive it against a
temp log_dir; no daemon or root needed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Luna 2026-06-10 05:17:29 -07:00
parent 9ebc355936
commit f2d896a2d7
4 changed files with 99 additions and 2 deletions

View file

@ -31,7 +31,7 @@ work that is bigger than single alerts.
world-writable PATH components, loose sensitive-file permissions, and disabled
package signatures. Still to come: unexpected enabled services and unsafe
systemd unit settings.
- Add a machine-readable `status --json` command for automation.
- Add a machine-readable `status --json` command for automation.
- Update the red-team harness so every current detection has a named drill and
expected `sid`.
- Document incident response runbooks for reverse shells, persistence, trojaned