enodia-sentinal/go-agent

Enodia Sentinel Go Agent (Phase 1 Prototype)

This directory is the parallel Go implementation described in docs/SURICATA_ASSIMILATION.md. Python remains the production agent and the behavioral oracle until every subsystem reaches fixture and red-team parity.

Current scope:

• standard-library-only flat TOML loading for the settings used so far;
• an injectable /proc process/file-descriptor snapshot plus fail-open ss socket collection;
• a cancellable sweep loop that emits JSONL enodia.event.v1 records;
• exact enodia.alert.v1 parity for ld_preload (SID 100011), deleted_exe (100012), input_snooper (100032), and credential_access (100033), plus reverse_shell (100010), egress (100016), and stealth_network (100036);
• enodia.status.v1 heartbeat records with no persistence or retained-alert claims;
• a shared fixture checked against the Python detector by scripts/check-go-parity.py.

It does not install a service, write Python state, capture eBPF events, retain snapshots, or replace enodia-sentinel. Run a single terminal-visible sweep:

cd go-agent
GOCACHE=/tmp/enodia-go-cache go run ./cmd/enodia-sentinel-go --once

Development verification from the repository root:

make test-go
make parity-go

--fixture, --host, --timestamp, and --proc-root exist for deterministic parity/testing. Production work should continue to use the default live /proc, hostname, and local timestamp.