wiki: add demo_forensic.py to Architecture component breakdown
wiki: add sim_writeoffset_only.py to Architecture simulations table
docs(architecture): add sim_all.py to simulations table
3xcv
committed
Jun 13, 2026
docs(architecture): add sim_random.py to simulations table
3xcv
committed
Jun 13, 2026
docs(architecture): add sim_depth.py to simulations table
3xcv
committed
Jun 13, 2026
docs(architecture): add sim_dfs.py to simulations table
3xcv
committed
Jun 13, 2026
wiki: v2.1.0 refresh — eBPF Phase 3, setup, roadmap, architecture, detection engine
- Home.md: update to v2.1.0; add version history table; add project board and release links
- Roadmap.md: restructure by milestone (v2.1.0/v2.2.0); add CI/eBPF Phase 3 completed items; separate Dependabot breaking PRs warning
- Installation-and-Setup.md: add linux-headers to BCC install; add kernel version verification step; add eBPF Mode section; add troubleshooting table
- Detection-Engine.md: add Attack Simulations section with usage commands and LockBit 5.0 4-metric validation table
- Architecture.md: expand eBPF sensor capabilities to include proc_profile map details, family profiling, IGNORE_COMMS, Markov disabled note
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
docs(wiki): update eBPF section for 5-syscall + BPF LSM + 4-prefix canaries
- Detection-Engine: expand Layer 6 eBPF with 5-syscall system (openat,
vfs_write, unlink, rename, execve), proc_profile BPF map, behavioral
scoring (5 signals 0-100), BPF LSM canary blocking (-EPERM),
blocked_pids map, entropy verification, IGNORE_COMMS 40+ processes,
run modes, Markov-disabled note, lsm=bpf activation instructions
- Detection-Engine: update Layer 1 canary — 4 prefixes (AAA_, aaa_,
ZZZ_, zzz_), CANARY_COUNT default 30, kernel-level inode blocking note
- Configuration: CANARY_COUNT default 30; SENSOR_BACKEND description
updated; add BPF LSM and Docker network sections; .env example updated
- Architecture: add eBPF current capabilities note (5-syscall, LSM,
Markov disabled); add Docker Network section with static IP table
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
docs(wiki): update all pages for eBPF sensor, SIEM redesign, D3 graph
- Architecture: React 19, eBPF+inotify dual-sensor diagram, new SIEM
frontend components (TopBar, StatusBar, FacetRail, MetricsStrip,
AlertsHistogram, AlertsTable, DetailFlyout, EventDetailModal,
FileSystemGraph); added design system table; simulations table
- Detection-Engine: add Layer 6 eBPF section (TRACEPOINT_PROBE, velocity
burst, family profiling, BCC 0.35 requirements, SENSOR_BACKEND)
- Configuration: add SENSOR_BACKEND and DRY_RUN optional variables;
update .env example with commented eBPF/dry-run lines
- Installation-and-Setup: add BCC install step; Node.js 22 prerequisite;
renumber steps; add inotify fallback note
- Known-Issues-and-Fixes: add problems 10-13 (CORS relative URL fix,
duplicate processes after git pull, eBPF BCC not installed, npm ENOTEMPTY)
- Roadmap: move Graph View to Completed (D3 done); add eBPF sensor,
SIEM redesign, attack simulations, LockBit test suite to Completed;
update dependency bump table; refresh Open items
- Project-Overview: add eBPF sensor + SIEM dashboard to capabilities;
update tech stack (D3 v7, BCC, Node.js 22, IBM Plex fonts)
- Home: update tagline to mention eBPF and SIEM dashboard
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
docs(wiki): bring all 11 pages up to date with current project state
- Home: added landing page link, updated page descriptions
- Project-Overview: updated AI stack (Cerebras/NVIDIA/Groq), added extension detection
- Installation-and-Setup: added setup.sh, fixed all startup commands
- Configuration: fixed env var names (AI_API_KEY -> NVIDIA_API_KEY), added Cerebras, removed 3 fake vars
- Detection-Engine: added Layer 4 extension detection, dpkg verification, entropy memory cap
- Auto-Containment: added tree-aware detail (two-sweep, 48 files, UID-based iptables)
- AI-Threat-Analyst: added multi-provider chain, PENDING state, 24h Redis cache
- Roadmap: moved CI+Tests+Reports to Completed, updated In Progress to real open items
- Known-Issues-and-Fixes: updated canary fix (3-layer prevention), added AI WebSocket fix, added auto-ack ID fix
- Architecture: added FilesystemPage+ReportsPage, updated ai_analyst description, updated data flow
- API-Reference: added new event types, date filters, with-events endpoint, ai_analysis_update message
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
docs: add full project wiki — overview, architecture, detection engine, setup, API, issues, roadmap