banner
BGIcon

What's Planned

Sentinel is a planned runtime threat sensor for Linux built on eBPF. By attaching to the kernel rather than living in userland, it can observe syscalls, process lineage, and network activity with very low overhead and without easy tampering. The aim is a small, transparent detection engine that ships behavioral signals — unexpected child processes, suspicious outbound connections, credential-file access — to a defender, pairing naturally with the deception telemetry from Mockingbird.

Planned Stack

  • - eBPF / libbpf
  • - C / Go
  • - CO-RE
  • - Linux kernel tracing
BG
Icon

  • Status

    Upcoming

  • Target

    2026 – 2027

  • Role

    Solo Developer

Why I'm Building It

Coming from the offensive side, I want to understand exactly which behaviors are cheap to detect at the kernel level — and which an attacker can hide.

eBPF is the modern foundation for both observability and EDR; building on it rounds out my detection-engineering skill set.

Back to Portfolio Entries