ShellSentinel is a Bash-based defensive detection framework for simulated security logs.
It implements:
- normalized event schema
- plugin-based detectors
- finding correlation into incidents
- risk scoring
- timeline reconstruction
- explain mode
- replay mode
- text and JSON reporting
bash bin/shellsentinel.sh help
bash bin/shellsentinel.sh doctor
bash bin/shellsentinel.sh analyze scenarios/multi_stage_incident.log
bash bin/shellsentinel.sh testShellSentinel is defensive-only.
It:
- analyzes simulated or safe logs
- does not execute malicious behavior
- does not create persistence
- does not modify startup entries
- does not perform real network activity
- does not encrypt, delete, hide, or alter user files
- expects detector plugins to only read normalized logs and write findings