luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(go): port process access detectors

Browse source
This commit is contained in:
Luna 2026-07-10 05:19:56 -07:00
parent f02509aab5
commit fc9b5f0448
22 changed files with 554 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

32
scripts/check-go-parity.py
View file

@ -9,13 +9,19 @@ import subprocess
import sys
from pathlib import Path
from types import SimpleNamespace
from unittest.mock import patch
ROOT = Path(__file__).resolve().parents[1]
sys.path.insert(0, str(ROOT))
from enodia_sentinel import __version__, event # noqa: E402
from enodia_sentinel.config import Config # noqa: E402
from enodia_sentinel.detectors import deleted_exe # noqa: E402
from enodia_sentinel.detectors import ( # noqa: E402
credential_access,
deleted_exe,
input_snooper,
ld_preload,
)
from enodia_sentinel.system import SystemState # noqa: E402
HOST = "parity-host"
@ -23,13 +29,14 @@ TIMESTAMP = "2026-07-10T00:00:00-07:00"
def main() -> int:
fixture = ROOT / "tests/fixtures/go/deleted-exe.json"
fixture = ROOT / "tests/fixtures/go/process-detectors.json"
fixture_data = json.loads(fixture.read_text())
env = os.environ.copy()
env.pop("ENODIA_CONFIG", None)
env["GOCACHE"] = "/tmp/enodia-go-cache"
command = [
"go", "run", "./cmd/enodia-sentinel-go",
"--config", str(ROOT / "tests/fixtures/go/no-such-config.toml"),
"--once", "--fixture", str(fixture),
"--host", HOST, "--timestamp", TIMESTAMP,
]
@ -43,13 +50,25 @@ def main() -> int:
go_events = [json.loads(line) for line in result.stdout.splitlines() if line]
go_alerts = [record for record in go_events if record["event_type"] == "alert"]
processes = [SimpleNamespace(**item) for item in fixture_data["processes"]]
processes = []
for raw_process in fixture_data["processes"]:
process = dict(raw_process)
process.setdefault("environ", {})
process.setdefault("fd_targets", {})
processes.append(SimpleNamespace(**process))
cfg = Config()
cfg.detectors = frozenset({"deleted_exe"})
state = SystemState(processes=processes, sockets=[])
with patch.object(ld_preload, "Path") as path_class:
preload = path_class.return_value
preload.is_file.return_value = bool(fixture_data.get("ld_preload"))
preload.read_text.return_value = fixture_data.get("ld_preload", "")
alerts = list(ld_preload.detect(state, cfg))
alerts.extend(deleted_exe.detect(state, cfg))
alerts.extend(input_snooper.detect(state, cfg))
alerts.extend(credential_access.detect(state, cfg))
python_alerts = [
event.from_alert(alert, host=HOST, timestamp=TIMESTAMP)
for alert in deleted_exe.detect(state, cfg)
for alert in alerts
]
if go_alerts != python_alerts:
print("Go/Python alert parity mismatch", file=sys.stderr)
@ -64,7 +83,8 @@ def main() -> int:
if status.get("schema") != "enodia.status.v1" or status.get("version") != __version__:
print("Go status schema/version drifted from Python", file=sys.stderr)
return 1
print(f"parity ok: {len(go_alerts)} deleted_exe alert events")
signatures = sorted({record["alert"]["signature"] for record in go_alerts})
print(f"parity ok: {len(go_alerts)} alerts across {', '.join(signatures)}")
return 0