41 lines
2.1 KiB
Markdown
41 lines
2.1 KiB
Markdown
# Enodia Sentinel Documentation Index
|
|
|
|
Applies to package version: `0.7.0`
|
|
Docs version: `0.7`
|
|
Schema generation: `v1`
|
|
|
|
This index is the versioned entry point for local operator documentation. When
|
|
the package version changes, update `docs/VERSION.json` and this file in the
|
|
same patch as any command, schema, or behavior documentation changes.
|
|
|
|
## Operator References
|
|
|
|
| Document | Purpose |
|
|
|---|---|
|
|
| [COMMAND_REFERENCE.md](COMMAND_REFERENCE.md) | Manpage-style CLI and service command contract. |
|
|
| [SCHEMAS.md](SCHEMAS.md) | Stable JSON schema IDs and required v1 fields. |
|
|
| [OPERATIONS.md](OPERATIONS.md) | Install checks, health checks, alert workflow, baseline hygiene, and evidence export. |
|
|
| [PACKAGING.md](PACKAGING.md) | Arch package layout and Debian/RPM source-install paths. |
|
|
| [RUNBOOKS.md](RUNBOOKS.md) | Incident response playbooks for common Sentinel findings. |
|
|
| [RULES.md](RULES.md) | Generated built-in event-rule reference by SID. |
|
|
|
|
## Product and Security References
|
|
|
|
| Document | Purpose |
|
|
|---|---|
|
|
| [SPECIFICATION.md](SPECIFICATION.md) | Product model, current scope, data model, and acceptance criteria. |
|
|
| [ROADMAP.md](ROADMAP.md) | Release tracks and planned sequencing. |
|
|
| [THREAT_MODEL.md](THREAT_MODEL.md) | Trust boundaries, attacker assumptions, and non-goals. |
|
|
| [FLEET_DESIGN.md](FLEET_DESIGN.md) | Optional v1.2 collector design: enrollment, ingest, storage, and safety boundaries. |
|
|
| [SURICATA_ASSIMILATION.md](SURICATA_ASSIMILATION.md) | Design proposal: assimilate Suricata's models (rule language, sessions, DPI, EVE schema), migrate to Go, add reactive forensic capture. |
|
|
|
|
## Versioning Rules
|
|
|
|
- Documentation tracks the package minor line, not individual commits.
|
|
- Additive JSON fields are allowed within a schema generation; required v1
|
|
fields stay stable.
|
|
- Command behavior changes must update [COMMAND_REFERENCE.md](COMMAND_REFERENCE.md).
|
|
- New operator-facing JSON contracts must update [SCHEMAS.md](SCHEMAS.md) and
|
|
compatibility tests.
|
|
- Roadmap checkboxes should only be marked complete after code, docs, and tests
|
|
all reflect the shipped behavior.
|