SENTINEL
A small C-based Linux telemetry daemon for rapid incident response and threat hunting, emitting portable JSON events without requiring a heavyweight endpoint platform.
Problem
Response teams often need immediate host visibility before a full EDR or SIEM integration can be deployed. SENTINEL aims to provide useful process, file, network, and authentication context with minimal dependencies and very little operational ceremony.
Constraints
- Remain lightweight enough for rapid deployment on Linux hosts, containers, and lab systems.
- Emit structured events that can flow into existing logging stacks instead of inventing a proprietary backend.
- Collect useful host context while keeping the implementation understandable and auditable.
- Preserve a path toward richer detection and evidence collection without turning the sensor into a remote-control agent.
Architecture
- 01
A /proc scanner discovers process activity while inotify watches sensitive files and network inspection tracks listener changes.
- 02
Collectors normalize observations into line-oriented JSON events on standard output.
- 03
Deployment can remain native or containerized, with downstream transport delegated to tools such as Fluent Bit, syslog, Loki, Splunk, or Wazuh.
- 04
Future phases add event-driven kernel interfaces, filtering, rule evaluation, enrichment, and evidence-preservation actions.
Failures / lessons
- Small sensors are easier to deploy during an incident when they do not demand a new management plane first.
- A neutral event stream lets collection stay decoupled from whatever SIEM happens to be available.
- Detection logic and collection mechanics should evolve independently so richer rules do not make the sensor harder to trust.