luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(go): port process access detectors

Browse source
This commit is contained in:
Luna 2026-07-10 05:19:56 -07:00
parent f02509aab5
commit fc9b5f0448
22 changed files with 554 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

9
README.md
View file

@ -65,10 +65,11 @@ Project docs:
> red-team harness, so every signature is exercised against both.
Phase 1 now also has an **experimental Go sidecar** under `go-agent/`. It emits
the same `enodia.event.v1` envelope, captures an injectable `/proc` process
view, and ports `deleted_exe` as the first parity-checked poll detector. It is
stdout-only and does not replace, install over, or write state for the Python
daemon; Python remains authoritative until subsystem parity is complete.
the same `enodia.event.v1` envelope and captures an injectable `/proc` process
view. The first parity-checked cohort is `ld_preload`, `deleted_exe`,
`input_snooper`, and `credential_access`. It is stdout-only and does not
replace, install over, or write state for the Python daemon; Python remains
authoritative until subsystem parity is complete.
## Why these detectors