wiki: add dedicated GROQ_API_KEY, GROQ_BASE_URL, GROQ_MODEL vars to Configuration page

adnanalshrouqi committed Jun 18, 2026

docs(wiki): update eBPF section for 5-syscall + BPF LSM + 4-prefix canaries - Detection-Engine: expand Layer 6 eBPF with 5-syscall system (openat, vfs_write, unlink, rename, execve), proc_profile BPF map, behavioral scoring (5 signals 0-100), BPF LSM canary blocking (-EPERM), blocked_pids map, entropy verification, IGNORE_COMMS 40+ processes, run modes, Markov-disabled note, lsm=bpf activation instructions - Detection-Engine: update Layer 1 canary — 4 prefixes (AAA_, aaa_, ZZZ_, zzz_), CANARY_COUNT default 30, kernel-level inode blocking note - Configuration: CANARY_COUNT default 30; SENSOR_BACKEND description updated; add BPF LSM and Docker network sections; .env example updated - Architecture: add eBPF current capabilities note (5-syscall, LSM, Markov disabled); add Docker Network section with static IP table Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Mohhudib committed Jun 5, 2026

docs(wiki): update all pages for eBPF sensor, SIEM redesign, D3 graph - Architecture: React 19, eBPF+inotify dual-sensor diagram, new SIEM frontend components (TopBar, StatusBar, FacetRail, MetricsStrip, AlertsHistogram, AlertsTable, DetailFlyout, EventDetailModal, FileSystemGraph); added design system table; simulations table - Detection-Engine: add Layer 6 eBPF section (TRACEPOINT_PROBE, velocity burst, family profiling, BCC 0.35 requirements, SENSOR_BACKEND) - Configuration: add SENSOR_BACKEND and DRY_RUN optional variables; update .env example with commented eBPF/dry-run lines - Installation-and-Setup: add BCC install step; Node.js 22 prerequisite; renumber steps; add inotify fallback note - Known-Issues-and-Fixes: add problems 10-13 (CORS relative URL fix, duplicate processes after git pull, eBPF BCC not installed, npm ENOTEMPTY) - Roadmap: move Graph View to Completed (D3 done); add eBPF sensor, SIEM redesign, attack simulations, LockBit test suite to Completed; update dependency bump table; refresh Open items - Project-Overview: add eBPF sensor + SIEM dashboard to capabilities; update tech stack (D3 v7, BCC, Node.js 22, IBM Plex fonts) - Home: update tagline to mention eBPF and SIEM dashboard Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Mohhudib committed Jun 5, 2026

docs(wiki): bring all 11 pages up to date with current project state - Home: added landing page link, updated page descriptions - Project-Overview: updated AI stack (Cerebras/NVIDIA/Groq), added extension detection - Installation-and-Setup: added setup.sh, fixed all startup commands - Configuration: fixed env var names (AI_API_KEY -> NVIDIA_API_KEY), added Cerebras, removed 3 fake vars - Detection-Engine: added Layer 4 extension detection, dpkg verification, entropy memory cap - Auto-Containment: added tree-aware detail (two-sweep, 48 files, UID-based iptables) - AI-Threat-Analyst: added multi-provider chain, PENDING state, 24h Redis cache - Roadmap: moved CI+Tests+Reports to Completed, updated In Progress to real open items - Known-Issues-and-Fixes: updated canary fix (3-layer prevention), added AI WebSocket fix, added auto-ack ID fix - Architecture: added FilesystemPage+ReportsPage, updated ai_analyst description, updated data flow - API-Reference: added new event types, date filters, with-events endpoint, ai_analysis_update message Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Mohhudib committed May 29, 2026

docs: add full project wiki — overview, architecture, detection engine, setup, API, issues, roadmap

Mohhudib committed Apr 26, 2026