CyberMind 62e8631f2b feat(sentinel): C2/botnet auto-learning — high-precision, report-only (Closes #826) (#827) ... * docs: spec — Sentinel C2/botnet auto-learning (high-precision, report-only) (ref #823) * docs: implementation plan — Sentinel C2/botnet auto-learning (ref #823) * feat(sentinel): C2 autolearn false-positive allowlist gate (ref #826) * fix(sentinel): serialize c2allow Add + robust atomicWriteFile (relative-path + temp cleanup) (ref #826) * feat(sentinel): C2 autolearn corroborating signals (rare/non-browser-JA/DGA) (ref #826) * feat(sentinel): C2 autolearn candidate lifecycle + persistence (ref #826) * fix(sentinel): c2cand deep-copy snapshots (persist/snapshot/record race) + evict order + device cap (ref #826) * feat(sentinel): C2 autolearn orchestrator — learned set + report-only verdicts (ref #826) * feat(sentinel): wire C2 learner into daemon + /c2 endpoints + seeded allowlist (ref #826) * fix(sentinel): make /c2/allow writable in packaged deploy (RW path + ownership) + sanitize Add (ref #826) POST /c2/allow could never write in production: sbx-sentinel.service runs User=secubox-toolbox under ProtectSystem=strict + ReadOnlyPaths=/etc/secubox, and the seeded c2-allow.txt ships root:root. Fix both halves: nest ReadWritePaths=/etc/secubox/sentinel under the existing ReadOnlyPaths=/etc/secubox in the unit, and chown/chmod 0750 the sentinel/ subdir + file (never the shared /etc/secubox parent) in postinst's configure branch, fail-safe. Also: fix the /c2/allow doc comment (form/query only, not JSON — r.FormValue never parses a body), and sanitize C2Allow.Add against newline injection now that host is network-reachable. * feat(toolbox): WebUI C2 appris sub-view + Ignorer allowlist proxy (ref #826) * fix(toolbox): C2 view XSS (data-host not onclick) + normalize candidate signal maps (ref #826) * fix(sentinel): bound c2 beaconing/learned maps + drop promoted from candidates + reject bare-TLD allow (ref #826) --------- Co-authored-by: CyberMind-FR <gandalf@Gk2.net>		2026-07-07 07:46:19 +02:00
..
architecture
assets
cspn
demos	feat(toolbox): activate Sentinel + surface compromise detections (WebUI tab · kbin report · PDF) — ref #823 (#825)	2026-07-06 17:39:42 +02:00
design
errata
eye-remote
hardware
marketing
notes	docs(notes): Gondwana trust-substrate poster research-note — vulgarized sketch + image-gen prompt + roadmap	2026-07-01 15:15:44 +02:00
reference
references/gst
reports
screenshots	docs(wiki): refonte 126 modules — snapshots WebUI déterministes + READMEs 4 langues (ref #742)	2026-06-26 10:14:14 +02:00
specs
superpowers	feat(sentinel): C2/botnet auto-learning — high-precision, report-only (Closes #826) (#827)	2026-07-07 07:46:19 +02:00
wiki	docs(wiki): drop decommissioned Authelia SSO from Modules catalog (128→127)	2026-07-04 07:00:50 +02:00
AI-BUILD-PROMPT.md
AI-HANDOVER-cabine-evolution.md
AI-HANDOVER-mistral.md
CACHE-PATTERN.md
FAQ-BUSYBOX-RESCUE.md
FAQ-KBIN-TOR.md	chore(toolbox): 2.7.0 middle release — kbin milestone + Tor chapter (ref #683)	2026-06-19 11:48:32 +02:00
FAQ-LXC-DNS.md
grammar.md
LED-HEALTHBUMP.md
LIVE-USB.md
MODULE-GUIDELINES.md
MODULES.md
OPENWRT-CRT-THEME.md
OPENWRT-DEBIAN-COMPARISON.md
OPENWRT-MASTERLINK.md
OPENWRT-MESH-DAEMON.md
P2P-EVOLUTIONS-POSTER-PROMPT.md	secubox-p2p: Kademlia DHT + federation health-checks + hierarchical master-link (#774) (#775)	2026-07-03 06:59:35 +02:00
PROMPT-BUSYBOX-TECHTIP.md
SCREENSHOTS-VM.md
SECUBOX-DEV-METHODOLOGY.md
TOOLS.md
UI-GUIDE.md