# Enodia Sentinel configuration
# Sourced by /usr/local/bin/sentinel.sh at startup (bash variable assignments).
# Restart after editing:  sudo systemctl restart enodia-sentinel.service

# --- timing --------------------------------------------------------------
SAMPLE_INTERVAL=4          # seconds between detector sweeps
COOLDOWN=60                # min seconds before re-alerting the same signature
BASELINE_GRACE=10          # seconds after start before new-listener/suid arm
SUID_REFRESH=3600          # seconds between SUID baseline refreshes
SUID_SCAN_INTERVAL=60      # seconds between filesystem-wide SUID scans (expensive)

# --- detector toggles (1 = on, 0 = off) ----------------------------------
DET_REVERSE_SHELL=1        # shell/interpreter with a socket on stdio
DET_LD_PRELOAD=1           # ld.so.preload rootkit / LD_PRELOAD in temp dirs
DET_DELETED_EXE=1          # process running from deleted/memfd binary
DET_NEW_LISTENER=1         # listening port not present at baseline
DET_NEW_SUID=1             # new SUID/SGID binary
DET_PERSISTENCE=1          # cron/systemd/authorized_keys/rc file changes
DET_EGRESS=1               # interpreter with outbound conn to public IP

# --- tuning --------------------------------------------------------------
# Process names treated as "interpreters" for reverse-shell / egress checks.
INTERPRETERS="bash sh dash zsh ksh ash nc ncat netcat socat telnet python python2 python3 perl ruby php lua awk"

# Trusted public CIDRs that should NOT trip the egress detector (your VPS,
# your VPN exit, monitoring endpoints, etc.). Space separated.
EGRESS_ALLOW_CIDRS=""

# Listener ports that never alert even if they appear after baseline.
LISTENER_ALLOW_PORTS=""

# Dirs where any SUID binary is treated as CRITICAL (attacker-writable).
SUID_HOT_DIRS="/tmp /dev/shm /var/tmp /home /run/user"

# Persistence files/dirs to watch for modification (globs ok).
# Append the red-team sandbox here to test the persistence drill safely.
WATCH_PERSISTENCE="/etc/cron.d /etc/crontab /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /var/spool/cron /etc/systemd/system /etc/ld.so.preload /etc/passwd /etc/sudoers /etc/sudoers.d /root/.ssh/authorized_keys /root/.bashrc /root/.profile"

# --- eBPF on-ramp --------------------------------------------------------
# Run a 3s bpftrace execve trace inside each snapshot to catch short-lived
# processes that polling misses. Requires the 'bpftrace' package.
CAPTURE_EXECVE_BPFTRACE=0

# --- retention -----------------------------------------------------------
MAX_SNAPSHOTS=300          # auto-delete oldest beyond this (0 = no cap)
MAX_SNAPSHOT_AGE_DAYS=60   # auto-delete older than this (0 = no age cap)

# --- notifications -------------------------------------------------------
NOTIFY_USERS=""            # e.g. "luna" — desktop notify-send on alert
NOTIFY_URGENCY=critical    # low / normal / critical