You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
- Upgraded all projects to net10.0-windows
- Resolved nullable reference warnings for C# 12 strict compliance
- Fixed net48 legacy build support by forcing LangVersion latest
- Added central Directory.Build.props for version 2.6.0 management
- Added dynamic UI telemetry for loaded plugins
- Display physical SMBIOS hardware hash on the dashboard
- Fixed build_and_run.ps1 to build full solution
- Updated HANDOVER, SETUP, and ARCHITECTURE documentation for v3.0 mesh roadmap
To transition from a host-based standalone agent into an offline-first distributed network, SentryShield is adopting a **Resilient Star-Mesh Architecture**:
45
+
46
+
1.**Star Node Authority**: A primary Centralized Management Console (CMC) or dedicated "Star Node" acts as the source of truth for YARA rules, CVE updates, and policy distribution.
47
+
2.**mDNS/UDP Fallback**: In the event of a severed network connection to the Star Node, endpoints fallback to local subnet broadcasts to locate surviving peer neighbors using cached routing tables.
48
+
3.**Monotonic Validation**: Because ICS environments are highly susceptible to clock drift, all threat data is synchronized using strict **Monotonic Sequence Numbers** (e.g., `Intelligence_v1042`) backed by cryptographic signatures, entirely replacing timestamp reconciliation.
49
+
4.**Thundering Herd Protection**: Endpoints attempting to reconnect to a recovering Star Node utilize exponential backoff combined with randomized jitter to prevent accidental DDoS floods.
50
+
51
+
---
52
+
42
53
## Component Responsibilities
43
54
44
-
### SentryService — C# .NET 8 Worker Service
55
+
### SentryService — C# .NET 10 Worker Service
45
56
-**Lifecycle**: Registered as a Windows service (`sc create SentryShield`)
46
57
-**SentryWorker**: Background polling loop; triggers scans on configurable interval
Copy file name to clipboardExpand all lines: Docs/HANDOVER.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -18,9 +18,9 @@ The system is divided into four pillars: Vulnerability Matching, USB Threat Dete
18
18
## Known Limitations & Remaining Work
19
19
For the team taking over `v3.0` and beyond, be aware of the following:
20
20
21
-
1.**Distributed Syncing (Phase 3):** The `MeshPlugin` (Gossip protocol) is explicitly NOT built. Implementing mTLS mutual authentication in an air-gapped factory will require significant PKI infrastructure design.
21
+
1.**Distributed Syncing (Phase 3):** The **Resilient Star-Mesh Architecture** (Star Node authoritative updates, mDNS/UDP fallback, Monotonic Sequence Validation) is explicitly NOT built. Implementing mTLS mutual authentication and conflict-free data replication in an air-gapped factory will require significant PKI infrastructure design.
22
22
2.**Nullable Warnings:** There are a few remaining nullable reference type warnings (e.g., in `IDSPluginTests.cs` and `VulnerabilityMatcher.cs`) that should be cleaned up for strict C# 12 compliance.
23
-
3.**Target Frameworks:**`SentryCore.csproj` currently targets `net8.0-windows`. If the testing infrastructure entirely moves to `net10.0-windows`, ensure `SentryCore.csproj` is updated to reflect this to avoid NU1702 warnings.
23
+
3.**Target Frameworks:**The solution has fully migrated to `net10.0-windows` (from `.NET 8`). Ensure the testing infrastructure remains aligned to avoid NU1702 warnings.
24
24
4.**UI Refinements:**
25
25
- Display the loaded plugins and their versions in the Settings view.
26
26
- Surface the `SMBIOS` hash directly on the UI dashboard (it currently logs in the background but is not visualized).
***MeshPlugin (P2P Threat Syncing)**: Implementing an mDNS/UDP gossip protocol over the local factory LAN. If a machine detects a malicious hash, it broadcasts the IOC to all peers locally without needing an internet connection.
39
-
***Centralized Plant Dashboard**: A lightweight, on-premise centralized dashboard for the Shift Supervisor to view the health and threat status of all nodes in the building.
40
-
***Air-gapped Update Distribution**: Creating a localized update server (similar to WSUS) inside the factory DMZ that endpoints poll for new YARA rules and CVE databases.
38
+
***Resilient Star-Mesh Architecture**: Deploying a Centralized Management Console (CMC) as a "Star Node" acting as the authoritative source for intelligence. Integrating an mDNS/UDP local broadcast fallback allowing nodes to automatically locate surviving peers and sync data during severed network links.
39
+
***Centralized Management Console (CMC)**: A lightweight, on-premise dashboard for Shift Supervisors to push unified policies, YARA rules, and view the health of the entire factory node mesh.
40
+
***Monotonic Sequence Validation**: Enforcing strict Monotonic Sequence Numbers (e.g., `Intelligence_v1042`) accompanied by cryptographic signatures to safely reconcile decentralized threat intelligence without relying on unpredictable ICS network clocks.
41
41
***What it looks like to a Plant Operator**:
42
-
* The Shift Supervisor has a single monitor showing a map of the factory floor's endpoint health.
43
-
* If a rogue firmware update is blocked on Line 1, Line 2 is instantly inoculated against the same hash. The system feels alive and collaborative.
42
+
* The Shift Supervisor uses the CMC to monitor factory floor endpoint health.
43
+
* If a rogue firmware update is blocked on Line 1, the CMC instantly pushes the IOC to Line 2. If the CMC goes offline, Line 1 gossips the hash directly to Line 2 via the Star-Mesh fallback. The system remains strictly resilient.
44
44
***Key Risks**:
45
45
***Network Noise**: Gossip protocols in noisy OT environments require careful tuning to prevent network storms.
46
46
***Authentication**: Securing P2P communication requires mTLS, which introduces the heavy burden of managing PKI (Public Key Infrastructure) and certificate rotation in an air-gapped environment.
@@ -74,6 +74,6 @@ This path scales SentryShield into a tier-1, enterprise-grade OT security platfo
74
74
| :--- | :--- | :--- | :--- |
75
75
|**Focus**| Stabilization & Deployment | Local Connectivity & Automation | Global Scale & Active Mitigation |
- Visual Studio 2022+ (or VS Code with C# extension)
17
17
18
-
> ⚠️ **Windows 7 Note**: .NET 8 does not support Windows 7. For Win7 HMIs, the service must be recompiled targeting .NET Framework 4.8. See `Docs/WIN7_COMPAT.md` (v2.0).
18
+
> ⚠️ **Windows 7 Note**: .NET 10 does not support Windows 7. For Win7 HMIs, the service must be recompiled targeting .NET Framework 4.8. See `Docs/WIN7_COMPAT.md` (v2.0).
19
19
20
20
---
21
21
@@ -37,7 +37,7 @@ cd SentryPython
37
37
python -m venv venv
38
38
venv\Scripts\activate
39
39
40
-
pip install yara-python requests pytest
40
+
pip install yara-python pytest
41
41
```
42
42
43
43
> `schedule` is only needed if running `db_sync.py` in daemon mode (not needed in development).
0 commit comments