sentinels(8)

NAME

sentinels - host intrusion detection and response

SYNOPSIS

garrett status
garrett cases
garrett trust|stop|release|restore <case>
garrett update [--check]

Supported hosts: Linux, macOS, Windows.

DESCRIPTION

garrett watches running programs and their connections on the host. It scores activity locally and can pause or end a program it judges hostile. A web server starting a shell that downloads a script is one behavior it looks for.

A case records the signals and the action taken. The agent can quarantine dropped files and disable a cron job, Run key or service used for persistence. garrett restore <case> reverses cleanup after a mistaken stop.

The local agent is one program file and needs no account or kernel module.

BENCHMARKS

Current internal stopping-time figures: about 20 ms for rapid process-chain scenarios; under 5 ms for selected tool-driven scenarios. The test setup, clock boundaries, sample size and raw results have not yet been added to the README. These figures are not a guarantee for every host or attack.

RESPONSE MODES

kill: End the program and its child processes. Default.
pause: Freeze the program until an operator decides.
decide: Freeze the program, then ask the service's configured model to stop, release or hold it.
report: Record the case without stopping the program.

AI ANALYSIS

Optional. A configured service model can summarize a case or decide what happens to a frozen program in decide mode. The default local kill path does not call a model.

INSTALLATION

Linux and macOS:

curl -fsSL https://gary23w.github.io/sentinels/install.sh | sudo sh

Windows, from an elevated PowerShell:

irm https://gary23w.github.io/sentinels/install.ps1 | iex

Or download garrett-windows.zip, unpack it and run Install garrett.cmd.

To start with alerts only:

curl -fsSL https://gary23w.github.io/sentinels/install.sh | sudo sh -s -- --mode report

APT REPOSITORY

curl -fsSL https://gary23w.github.io/sentinels/garrett.gpg | sudo tee /usr/share/keyrings/garrett.gpg >/dev/null
echo "deb [signed-by=/usr/share/keyrings/garrett.gpg] https://gary23w.github.io/sentinels stable main" | sudo tee /etc/apt/sources.list.d/garrett.list
sudo apt update && sudo apt install garrett

FLEET SERVICE

Run the service on your own hardware to collect cases and share learned attack patterns across enrolled hosts. Cases stay on your service.

curl -fsSL https://gary23w.github.io/sentinels/service.sh | sudo sh

Windows service installation, from an elevated PowerShell:

irm https://gary23w.github.io/sentinels/service.ps1 | iex

Enrol another host:

curl -fsSL https://gary23w.github.io/sentinels/install.sh | sudo sh -s -- --server https://your-service --key <enrolment key>

For managed hosting, email info@garrettstimpson.ca.

UPDATES

The agent checks for new versions and verifies the project's signature before installing one. Set UPDATE=off in its configuration file to update by hand. The package signing key is 6857 EBCB BEF5 1040 C3F2 0107 3626 88BF C238 AB45. See checksums and the signed checksum file.