Skip to content

Commit edb09a0

Browse files
committed
feat(v2.6): complete tech debt, .NET 10 migration, and UI hardware telemetry
- Upgraded all projects to net10.0-windows - Resolved nullable reference warnings for C# 12 strict compliance - Fixed net48 legacy build support by forcing LangVersion latest - Added central Directory.Build.props for version 2.6.0 management - Added dynamic UI telemetry for loaded plugins - Display physical SMBIOS hardware hash on the dashboard - Fixed build_and_run.ps1 to build full solution - Updated HANDOVER, SETUP, and ARCHITECTURE documentation for v3.0 mesh roadmap
1 parent 95ea73b commit edb09a0

22 files changed

Lines changed: 325 additions & 106 deletions

File tree

Directory.Build.props

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
<Project>
2+
<PropertyGroup>
3+
<Version>2.6.0</Version>
4+
<Product>SentryShield</Product>
5+
<Company>SentryShield</Company>
6+
</PropertyGroup>
7+
</Project>

Docs/ARCHITECTURE.md

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -39,9 +39,20 @@ SentryShield is an **offline-first, lightweight security monitoring system** for
3939

4040
---
4141

42+
## Phase 3: Star-Mesh Architecture (Upcoming v3.0)
43+
44+
To transition from a host-based standalone agent into an offline-first distributed network, SentryShield is adopting a **Resilient Star-Mesh Architecture**:
45+
46+
1. **Star Node Authority**: A primary Centralized Management Console (CMC) or dedicated "Star Node" acts as the source of truth for YARA rules, CVE updates, and policy distribution.
47+
2. **mDNS/UDP Fallback**: In the event of a severed network connection to the Star Node, endpoints fallback to local subnet broadcasts to locate surviving peer neighbors using cached routing tables.
48+
3. **Monotonic Validation**: Because ICS environments are highly susceptible to clock drift, all threat data is synchronized using strict **Monotonic Sequence Numbers** (e.g., `Intelligence_v1042`) backed by cryptographic signatures, entirely replacing timestamp reconciliation.
49+
4. **Thundering Herd Protection**: Endpoints attempting to reconnect to a recovering Star Node utilize exponential backoff combined with randomized jitter to prevent accidental DDoS floods.
50+
51+
---
52+
4253
## Component Responsibilities
4354

44-
### SentryService — C# .NET 8 Worker Service
55+
### SentryService — C# .NET 10 Worker Service
4556
- **Lifecycle**: Registered as a Windows service (`sc create SentryShield`)
4657
- **SentryWorker**: Background polling loop; triggers scans on configurable interval
4758
- **ProcessRunner** (`IPC/ProcessRunner.cs`): Spawns Python subprocesses, captures JSON stdout, kills on 120s timeout
@@ -72,12 +83,13 @@ SentryShield is an **offline-first, lightweight security monitoring system** for
7283
| `yara_scanner.py` | Compiles `.yar` rules, scans files/dirs, outputs JSON to stdout |
7384
| `ioc_populate.py` | MalwareBazaar API + embedded ICS/OT threat hashes |
7485

75-
### SentryUI — WPF .NET 8 Dashboard
76-
- Dark industrial design system (`Resources/Styles.xaml`)
77-
- MVVM: `DashboardViewModel` with `INotifyPropertyChanged`, 30-second auto-refresh
86+
### SentryUI — WPF .NET 10 Dashboard
87+
- **Dark industrial design system** (`Resources/Styles.xaml`)
88+
- **MVVM**: `DashboardViewModel` with `INotifyPropertyChanged`, 30-second auto-refresh
7889
- **Findings tab**: Sortable `DataGrid`, severity badges, type/severity filters, acknowledge button
7990
- **Gateway tab**: Validation log — ALLOW/BLOCK/WARN/PENDING per file
8091
- **Settings tab**: Scan schedule, gateway toggles, DB path
92+
- **Star-Mesh Telemetry (Upcoming)**: Visualization of Star Node health, current failover state, and active Intelligence Sequence Number.
8193
- **Export**: JSON export via `SaveFileDialog`
8294

8395
---

Docs/HANDOVER.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,9 @@ The system is divided into four pillars: Vulnerability Matching, USB Threat Dete
1818
## Known Limitations & Remaining Work
1919
For the team taking over `v3.0` and beyond, be aware of the following:
2020

21-
1. **Distributed Syncing (Phase 3):** The `MeshPlugin` (Gossip protocol) is explicitly NOT built. Implementing mTLS mutual authentication in an air-gapped factory will require significant PKI infrastructure design.
21+
1. **Distributed Syncing (Phase 3):** The **Resilient Star-Mesh Architecture** (Star Node authoritative updates, mDNS/UDP fallback, Monotonic Sequence Validation) is explicitly NOT built. Implementing mTLS mutual authentication and conflict-free data replication in an air-gapped factory will require significant PKI infrastructure design.
2222
2. **Nullable Warnings:** There are a few remaining nullable reference type warnings (e.g., in `IDSPluginTests.cs` and `VulnerabilityMatcher.cs`) that should be cleaned up for strict C# 12 compliance.
23-
3. **Target Frameworks:** `SentryCore.csproj` currently targets `net8.0-windows`. If the testing infrastructure entirely moves to `net10.0-windows`, ensure `SentryCore.csproj` is updated to reflect this to avoid NU1702 warnings.
23+
3. **Target Frameworks:** The solution has fully migrated to `net10.0-windows` (from `.NET 8`). Ensure the testing infrastructure remains aligned to avoid NU1702 warnings.
2424
4. **UI Refinements:**
2525
- Display the loaded plugins and their versions in the Settings view.
2626
- Surface the `SMBIOS` hash directly on the UI dashboard (it currently logs in the background but is not visualized).

Docs/PRODUCTION_PATHWAYS.md

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -35,12 +35,12 @@ This path elevates SentryShield from an isolated endpoint tool to a networked, i
3535

3636
* **Investment Level**: 3-4 FTEs (1 Architect, 2 Software Engineers, 1 SecOps Analyst), 6-9 Months, ~$150k–$250k.
3737
* **What Gets Built or Hardened**:
38-
* **MeshPlugin (P2P Threat Syncing)**: Implementing an mDNS/UDP gossip protocol over the local factory LAN. If a machine detects a malicious hash, it broadcasts the IOC to all peers locally without needing an internet connection.
39-
* **Centralized Plant Dashboard**: A lightweight, on-premise centralized dashboard for the Shift Supervisor to view the health and threat status of all nodes in the building.
40-
* **Air-gapped Update Distribution**: Creating a localized update server (similar to WSUS) inside the factory DMZ that endpoints poll for new YARA rules and CVE databases.
38+
* **Resilient Star-Mesh Architecture**: Deploying a Centralized Management Console (CMC) as a "Star Node" acting as the authoritative source for intelligence. Integrating an mDNS/UDP local broadcast fallback allowing nodes to automatically locate surviving peers and sync data during severed network links.
39+
* **Centralized Management Console (CMC)**: A lightweight, on-premise dashboard for Shift Supervisors to push unified policies, YARA rules, and view the health of the entire factory node mesh.
40+
* **Monotonic Sequence Validation**: Enforcing strict Monotonic Sequence Numbers (e.g., `Intelligence_v1042`) accompanied by cryptographic signatures to safely reconcile decentralized threat intelligence without relying on unpredictable ICS network clocks.
4141
* **What it looks like to a Plant Operator**:
42-
* The Shift Supervisor has a single monitor showing a map of the factory floor's endpoint health.
43-
* If a rogue firmware update is blocked on Line 1, Line 2 is instantly inoculated against the same hash. The system feels alive and collaborative.
42+
* The Shift Supervisor uses the CMC to monitor factory floor endpoint health.
43+
* If a rogue firmware update is blocked on Line 1, the CMC instantly pushes the IOC to Line 2. If the CMC goes offline, Line 1 gossips the hash directly to Line 2 via the Star-Mesh fallback. The system remains strictly resilient.
4444
* **Key Risks**:
4545
* **Network Noise**: Gossip protocols in noisy OT environments require careful tuning to prevent network storms.
4646
* **Authentication**: Securing P2P communication requires mTLS, which introduces the heavy burden of managing PKI (Public Key Infrastructure) and certificate rotation in an air-gapped environment.
@@ -74,6 +74,6 @@ This path scales SentryShield into a tier-1, enterprise-grade OT security platfo
7474
| :--- | :--- | :--- | :--- |
7575
| **Focus** | Stabilization & Deployment | Local Connectivity & Automation | Global Scale & Active Mitigation |
7676
| **Timeline** | 1-2 Months | 6-9 Months | 1.5 - 2 Years |
77-
| **Core Feature** | Silent USB Blocking | P2P Threat Sharing | Kernel Driver & Network Isolation |
77+
| **Core Feature** | Silent USB Blocking | Star-Mesh & Failover Syncing | Kernel Driver & Network Isolation |
7878
| **Management** | Individual Nodes | Plant-Level Dashboard | Global SOC Console |
7979
| **Highest Risk** | Update Maintenance Overhead | PKI/Certificate Management | False Positives Haulting Production |

Docs/SETUP.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,11 +11,11 @@
1111
### Windows Machine (dev / target)
1212
- Windows 10 / 11 (64-bit) — or Windows Server 2019+
1313
- Administrator rights (for service install, WMI, Event Log)
14-
- .NET 8 SDK: https://dotnet.microsoft.com/download/dotnet/8.0
14+
- .NET 10 SDK: https://dotnet.microsoft.com/download/dotnet/10.0
1515
- Python 3.11: https://www.python.org/downloads/
1616
- Visual Studio 2022+ (or VS Code with C# extension)
1717

18-
> ⚠️ **Windows 7 Note**: .NET 8 does not support Windows 7. For Win7 HMIs, the service must be recompiled targeting .NET Framework 4.8. See `Docs/WIN7_COMPAT.md` (v2.0).
18+
> ⚠️ **Windows 7 Note**: .NET 10 does not support Windows 7. For Win7 HMIs, the service must be recompiled targeting .NET Framework 4.8. See `Docs/WIN7_COMPAT.md` (v2.0).
1919
2020
---
2121

@@ -37,7 +37,7 @@ cd SentryPython
3737
python -m venv venv
3838
venv\Scripts\activate
3939
40-
pip install yara-python requests pytest
40+
pip install yara-python pytest
4141
```
4242

4343
> `schedule` is only needed if running `db_sync.py` in daemon mode (not needed in development).

SentryPlugin.Abstractions/SentryPlugin.Abstractions.csproj

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
<Project Sdk="Microsoft.NET.Sdk">
22

33
<PropertyGroup>
4-
<TargetFrameworks>net8.0-windows;net48</TargetFrameworks>
4+
<TargetFrameworks>net10.0-windows;net48</TargetFrameworks>
5+
<LangVersion>latest</LangVersion>
56
<ImplicitUsings>enable</ImplicitUsings>
67
<Nullable>enable</Nullable>
78
<!-- Use Windows desktop APIs for .NET 8, harmless for net48 which already has them -->
8-
<UseWPF Condition="'$(TargetFramework)' == 'net8.0-windows'">true</UseWPF>
9+
<UseWPF Condition="'$(TargetFramework)' == 'net10.0-windows'">true</UseWPF>
910
</PropertyGroup>
1011

1112
<ItemGroup>

SentryPlugin.Firmware/SentryPlugin.Firmware.csproj

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<Project Sdk="Microsoft.NET.Sdk">
22

33
<PropertyGroup>
4-
<TargetFramework>net8.0-windows</TargetFramework>
4+
<TargetFramework>net10.0-windows</TargetFramework>
55
<Nullable>enable</Nullable>
66
<ImplicitUsings>enable</ImplicitUsings>
77
<OutputType>Library</OutputType>

SentryPlugin.IDS/SentryPlugin.IDS.csproj

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<Project Sdk="Microsoft.NET.Sdk">
22
<PropertyGroup>
3-
<TargetFramework>net8.0-windows</TargetFramework>
3+
<TargetFramework>net10.0-windows</TargetFramework>
44
<ImplicitUsings>enable</ImplicitUsings>
55
<Nullable>enable</Nullable>
66
<OutputType>Library</OutputType>

SentryPlugin.Remediation/SentryPlugin.Remediation.csproj

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<Project Sdk="Microsoft.NET.Sdk">
22

33
<PropertyGroup>
4-
<TargetFramework>net8.0-windows</TargetFramework>
4+
<TargetFramework>net10.0-windows</TargetFramework>
55
<ImplicitUsings>enable</ImplicitUsings>
66
<Nullable>enable</Nullable>
77
<OutputType>Library</OutputType>

SentryPlugin.USB/SentryPlugin.USB.csproj

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
<Project Sdk="Microsoft.NET.Sdk">
22

33
<PropertyGroup>
4-
<TargetFrameworks>net8.0-windows;net48</TargetFrameworks>
4+
<TargetFrameworks>net10.0-windows;net48</TargetFrameworks>
5+
<LangVersion>latest</LangVersion>
56
<ImplicitUsings>enable</ImplicitUsings>
67
<Nullable>enable</Nullable>
78
<!-- Use Windows desktop APIs for .NET 8, harmless for net48 which already has them -->
8-
<UseWPF Condition="'$(TargetFramework)' == 'net8.0-windows'">true</UseWPF>
9+
<UseWPF Condition="'$(TargetFramework)' == 'net10.0-windows'">true</UseWPF>
910
</PropertyGroup>
1011

1112
<ItemGroup>

0 commit comments

Comments
 (0)