Documentation
¶
Overview ¶
Package main provides the SENTINEL immune agent (SEC-002 eBPF Runtime Guard).
The immune agent monitors SOC processes at the kernel level using eBPF tracepoints and enforces per-process security policies.
On Linux: loads eBPF programs for syscall/file/network monitoring. On Windows/macOS: uses process monitoring fallback (polling /proc or WMI).
Usage:
go run ./cmd/immune/ --policy deploy/policies/soc_runtime_policy.yaml SOC_GUARD_MODE=enforce go run ./cmd/immune/
Source Files
Click to show internal directories.
Click to hide internal directories.