Issues

• [ADR] Real-time exec telemetry: source, privileges and deployment cost

  area:telemetrypriority:P0-blockertype:architecture
  MrGuato/pisentry#34 · Filter by author MrGuato opened on Oct 17, 2026 · v0.3.0: Real-time telemetry and fileless detection

• [PERF] Benchmarks and a performance budget for the event path in CI

  priority:P2-mediumtype:performance
  MrGuato/pisentry#33 · Filter by author MrGuato opened on Oct 17, 2026 · v0.2.0: Rule engine and detection foundations

• [TEST] Fuzz every parser that reads attacker input

  area:detectpriority:P1-hightype:testing
  MrGuato/pisentry#32 · Filter by author MrGuato opened on Oct 17, 2026 · v0.2.0: Rule engine and detection foundations

• [DOCS/TEST] ARM Hardware Benchmark Suite & v0.2.0 Documentation Overhaul

  arch:arm-verifiedpriority:P1-hightype:docstype:performance
  MrGuato/pisentry#28 · Filter by author MrGuato opened on Oct 17, 2026 · v0.5.0: k3s edge, ARM benchmarks and admission policy

• [K8S] Admission policy that verifies the pisentry image signature

  priority:P2-mediumtype:k8s-edge
  MrGuato/pisentry#27 · Filter by author MrGuato opened on Oct 17, 2026 · v0.5.0: k3s edge, ARM benchmarks and admission policy

• [K8S] Ship native PrometheusRule CRD manifests and updated Grafana dashboard

  priority:P1-hightype:k8s-edge
  MrGuato/pisentry#26 · Filter by author MrGuato opened on Oct 17, 2026 · v0.2.0: Rule engine and detection foundations

• [FEAT] Implement PS12 k3s / Kubernetes Edge Security & Container Escape Detector

  area:detectpriority:P1-hightype:featuretype:k8s-edge
  MrGuato/pisentry#25 · Filter by author MrGuato opened on Oct 17, 2026 · v0.5.0: k3s edge, ARM benchmarks and admission policy

• [FEAT] Firewall quarantine in a dedicated nftables table with TTL and a safe ignore list

  area:responsepriority:P2-mediumtype:feature
  MrGuato/pisentry#24 · Filter by author MrGuato opened on Oct 17, 2026 · v0.6.0: Active response, opt-in

• [FEAT] Build Active Response Engine with Process Tree Termination (internal/response)

  area:responsepriority:P1-hightype:feature
  MrGuato/pisentry#23 · Filter by author MrGuato opened on Oct 17, 2026 · v0.6.0: Active response, opt-in

• [FEAT] Add IP & CIDR Threat Intelligence Blocklist Matcher for PS02/PS05/PS09

  area:detectarea:rule-enginepriority:P2-mediumtype:feature
  MrGuato/pisentry#22 · Filter by author MrGuato opened on Oct 17, 2026 · v0.4.0: Persistent windows and correlation

• [FEAT] Implement Multi-Stage Attack Chain Correlator in Event Bus (internal/engine)

  area:state-correlationpriority:P1-hightype:feature
  MrGuato/pisentry#21 · Filter by author MrGuato opened on Oct 17, 2026 · v0.4.0: Persistent windows and correlation

• [FEAT] Upgrade PS01 with 24-hour Low-and-Slow & Distributed SSH Brute-Force Analytics

  area:detectarea:state-correlationpriority:P1-hightype:feature
  MrGuato/pisentry#20 · Filter by author MrGuato opened on Oct 17, 2026 · v0.4.0: Persistent windows and correlation

• [ARCH] Persist detector windows and add an integrity check to state.json (internal/state)

  area:state-correlationpriority:P1-hightype:architecture
  MrGuato/pisentry#19 · Filter by author MrGuato opened on Oct 17, 2026 · v0.4.0: Persistent windows and correlation

• [FEAT] Implement PS11 Dedicated Fileless & Shared-Memory Execution Detector (memfd_create & /dev/shm)

  area:detectpriority:P1-hightype:feature
  MrGuato/pisentry#18 · Filter by author MrGuato opened on Oct 17, 2026 · v0.3.0: Real-time telemetry and fileless detection

• [FEAT] Add real-time File Integrity Monitoring (FIM) using pure-Go Linux inotify

  area:detectarea:telemetrypriority:P1-hightype:feature
  MrGuato/pisentry#17 · Filter by author MrGuato opened on Oct 17, 2026 · v0.3.0: Real-time telemetry and fileless detection

• [FEAT] Real-time exec events: audit on Pi kernels, proc connector elsewhere, polling fallback (internal/execsrc)

  area:telemetrypriority:P0-blockertype:feature
  MrGuato/pisentry#16 · Filter by author MrGuato opened on Oct 17, 2026 · v0.3.0: Real-time telemetry and fileless detection

• [RULES] Curate initial v0.2.0 Attack Pattern Library (IoT Botnets, GTFOBins, Reverse Shells, Miners)

  area:detectpriority:P1-hightype:security-rules
  MrGuato/pisentry#15 · Filter by author MrGuato opened on Oct 17, 2026 · v0.2.0: Rule engine and detection foundations

• [FEAT] 'pisentry update-patterns' with Ed25519 signatures, version and expiry checks

  area:rule-enginepriority:P1-hightype:feature
  MrGuato/pisentry#14 · Filter by author MrGuato opened on Oct 17, 2026 · v0.2.0: Rule engine and detection foundations

• [FEAT] Add atomic hot-reloading of attack patterns via SIGHUP and file watching

  area:rule-enginepriority:P1-hightype:feature
  MrGuato/pisentry#13 · Filter by author MrGuato opened on Oct 17, 2026 · v0.2.0: Rule engine and detection foundations

• [PERF] Literal prefilter for rule matching (Aho-Corasick), only if benchmarks need it

  area:rule-enginepriority:P2-mediumtype:featuretype:performance
  MrGuato/pisentry#12 · Filter by author MrGuato opened on Oct 17, 2026 · v0.5.0: k3s edge, ARM benchmarks and admission policy