luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(go): port process access detectors

Browse source
This commit is contained in:
Luna 2026-07-10 05:19:56 -07:00
parent f02509aab5
commit fc9b5f0448
22 changed files with 554 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

9
go-agent/internal/agent/agent.go
View file

@ -57,9 +57,18 @@ func (a *Agent) Sweep() ([]map[string]any, error) {
timestamp := a.Now().Local().Format(time.RFC3339Nano)
alerts := make([]model.Alert, 0)
if a.Config.Enabled("ld_preload") {
alerts = append(alerts, detectors.LDPreload(state)...)
}
if a.Config.Enabled("deleted_exe") {
alerts = append(alerts, detectors.DeletedExe(state)...)
}
if a.Config.Enabled("input_snooper") {
alerts = append(alerts, detectors.InputSnooper(state, a.Config)...)
}
if a.Config.Enabled("credential_access") {
alerts = append(alerts, detectors.CredentialAccess(state, a.Config)...)
}
events := make([]map[string]any, 0, len(alerts)+1)
for _, alert := range alerts {
record, err := schema.Build("alert", alert, host, timestamp)