Modules & Security Findings

Ferro Sentry executes security audit modules and streams posture findings to SecuryBlack Cloud or your OTLP collector.

Module Reference & Status

Module Name	Status	Category	Description
port_scanner	Available	Audit	Audits listening interfaces, non-standard open ports, and unauthenticated exposed databases (Redis, Mongo).
vuln_scanner	Available	Posture	Audits SSH configs (PermitRootLogin, PasswordAuth), SUID/SGID binary permissions, world-writable files.
process_sentinel	In Development	EDR	Real-time process spawn tracking, shell execution from /tmp, memory injection, dangling binary executables.
file_integrity	In Development	FIM	inotify / ReadDirectoryChangesW tracking of /etc/passwd and binaries with SHA-256 baselines.
auth_guard	Roadmap	Logs	SSH brute-force detection, auth.log tailing, and failed login attempt tracking.

Security Finding Payload Example

Each posture finding emitted by Ferro Sentry follows this JSON structure:

Security Finding (JSON)

{
  "event_type": "finding",
  "category": "posture",
  "severity": "high",
  "timestamp": "2026-04-28T16:45:00Z",
  "host": "web-server-01",
  "agent": "ferro-sentry",
  "module": "ssh_auditor",
  "details": {
    "finding": "PermitRootLogin=yes",
    "recommendation": "Set PermitRootLogin=no in /etc/ssh/sshd_config",
    "file": "/etc/ssh/sshd_config",
    "benchmark": "CIS-5.2.8"
  }
}