39 lines
1.5 KiB
Markdown
39 lines
1.5 KiB
Markdown
# Enodia Sentinel Go Agent (Phase 1 Prototype)
|
|
|
|
This directory is the parallel Go implementation described in
|
|
`docs/SURICATA_ASSIMILATION.md`. Python remains the production agent and the
|
|
behavioral oracle until every subsystem reaches fixture and red-team parity.
|
|
|
|
Current scope:
|
|
|
|
- standard-library-only flat TOML loading for the settings used so far;
|
|
- an injectable `/proc` process/file-descriptor snapshot plus fail-open `ss`
|
|
socket collection;
|
|
- a cancellable sweep loop that emits JSONL `enodia.event.v1` records;
|
|
- exact `enodia.alert.v1` parity for `ld_preload` (SID `100011`),
|
|
`deleted_exe` (`100012`), `input_snooper` (`100032`), and
|
|
`credential_access` (`100033`), plus `reverse_shell` (`100010`), `egress`
|
|
(`100016`), and `stealth_network` (`100036`);
|
|
- `enodia.status.v1` heartbeat records with no persistence or retained-alert
|
|
claims;
|
|
- a shared fixture checked against the Python detector by
|
|
`scripts/check-go-parity.py`.
|
|
|
|
It does not install a service, write Python state, capture eBPF events, retain
|
|
snapshots, or replace `enodia-sentinel`. Run a single terminal-visible sweep:
|
|
|
|
```bash
|
|
cd go-agent
|
|
GOCACHE=/tmp/enodia-go-cache go run ./cmd/enodia-sentinel-go --once
|
|
```
|
|
|
|
Development verification from the repository root:
|
|
|
|
```bash
|
|
make test-go
|
|
make parity-go
|
|
```
|
|
|
|
`--fixture`, `--host`, `--timestamp`, and `--proc-root` exist for deterministic
|
|
parity/testing. Production work should continue to use the default live
|
|
`/proc`, hostname, and local timestamp.
|