sentinel

Documentation

Overview

Package sentinel performs client-independent, OS-level detection of the post-exploitation indicators a malicious provider's payload leaves behind: rogue processes, scheduled-task persistence, traffic redirection, and dropped files. It runs entirely outside the request hot path. The same checks back both `holone audit` (one-shot) and `holone sentinel` (continuous watch).

Index

• Constants
• func Monitor(ctx context.Context, interval time.Duration, onAlert func(Check))
• type Check
  • func Audit(ctx context.Context) []Check
  • func Infected(checks []Check) []Check

Constants

const (
	StatusClean    = "clean"
	StatusInfected = "infected"
	StatusWarn     = "warn"
	StatusError    = "error"
)

Status classifies a check result.

Functions

func Monitor

func Monitor(ctx context.Context, interval time.Duration, onAlert func(Check))

Monitor re-audits on each interval and reports newly flagged checks via onAlert. It blocks until ctx is cancelled.

Types

type Check

type Check struct {
	Name   string `json:"name"`
	Status string `json:"status"`
	Detail string `json:"detail"`
}

Check is the outcome of a single indicator probe.

func Audit

func Audit(ctx context.Context) []Check

Audit runs every available check once and returns the results.

func Infected

func Infected(checks []Check) []Check

Infected returns the subset of checks that flagged something or errored.