<?xml version="1.0" encoding="UTF-8"?>
<metadata xmlns="http://linux.duke.edu/metadata/common" xmlns:rpm="http://linux.duke.edu/metadata/rpm" packages="5">
<package type="rpm">
  <name>sys-inspector</name>
  <arch>noarch</arch>
  <version epoch="0" ver="1.0.1" rel="15.1"/>
  <checksum type="sha256" pkgid="YES">afa1b3f93b9fd79e7ad99465b6cf7526de4fd70316e59ed1eb201af0e1d5f7ca</checksum>
  <summary>System inspector and forensic tool using eBPF (Multi-Agent/Web)</summary>
  <description>Sys-Inspector is an advanced observability tool leveraging eBPF technology.
It provides real-time analysis of process execution, file I/O, network
connections, and security contexts.
It provides real-time analysis of:
- Process Execution (execve) with Hash Calculation
- File I/O (openat, vfs_read/write) with Zoning/HCTL info
- Network Connections (TCPv4)
- Memory Usage (RSS vs VSZ)
- Security Contexts (SSH Origin, Sudo, AppArmor)
- Multi-Agent Fleet Monitoring (Web Dashboard)
- Forensic Time Machine (Historical Snapshots)
It ships a Multi-Agent architecture, Fleet View, FHS compliant paths and
native systemd integration.
Designed for SREs and Forensic Analysts.</description>
  <packager></packager>
  <url>https://github.com/mariosergiosl/sys-inspector</url>
  <time file="1786974392" build="1786974390"/>
  <size package="344628" installed="1656589" archive="1690628"/>
  <location href="noarch/sys-inspector-1.0.1-15.1.noarch.rpm"/>
  <format>
    <rpm:license>AGPL-3.0-only</rpm:license>
    <rpm:vendor>obs://build.opensuse.org/home:mariosergiosl:sys-inspector</rpm:vendor>
    <rpm:group>System/Monitoring</rpm:group>
    <rpm:buildhost>h02-ch1c</rpm:buildhost>
    <rpm:sourcerpm>sys-inspector-1.0.1-15.1.src.rpm</rpm:sourcerpm>
    <rpm:header-range start="4504" end="41284"/>
    <rpm:provides>
      <rpm:entry name="sys-inspector" flags="EQ" epoch="0" ver="1.0.1" rel="15.1"/>
    </rpm:provides>
    <rpm:requires>
      <rpm:entry name="/bin/bash"/>
      <rpm:entry name="/bin/sh" pre="1"/>
      <rpm:entry name="/bin/sh"/>
      <rpm:entry name="/usr/bin/python3"/>
      <rpm:entry name="python(abi)" flags="EQ" epoch="0" ver="3.6"/>
      <rpm:entry name="python3"/>
      <rpm:entry name="python3-PyYAML"/>
      <rpm:entry name="python3-cryptography"/>
      <rpm:entry name="systemd" pre="1"/>
      <rpm:entry name="systemd"/>
    </rpm:requires>
    <file>/usr/bin/generate_keys.py</file>
    <file>/usr/bin/install_deps.sh</file>
    <file>/usr/bin/install_service.bash</file>
    <file>/usr/bin/setup_env.sh</file>
    <file>/usr/bin/sys-inspector</file>
    <file>/usr/sbin/rcsys-inspector</file>
  </format>
</package>
<package type="rpm">
  <name>sys-inspector</name>
  <arch>src</arch>
  <version epoch="0" ver="1.0.1" rel="15.1"/>
  <checksum type="sha256" pkgid="YES">1982315036da44ea363210531bad33fcb8ce4d68b0018ea19e32bde92fdc3643</checksum>
  <summary>System inspector and forensic tool using eBPF (Multi-Agent/Web)</summary>
  <description>Sys-Inspector is an advanced observability tool leveraging eBPF technology.
It provides real-time analysis of process execution, file I/O, network
connections, and security contexts.
It provides real-time analysis of:
- Process Execution (execve) with Hash Calculation
- File I/O (openat, vfs_read/write) with Zoning/HCTL info
- Network Connections (TCPv4)
- Memory Usage (RSS vs VSZ)
- Security Contexts (SSH Origin, Sudo, AppArmor)
- Multi-Agent Fleet Monitoring (Web Dashboard)
- Forensic Time Machine (Historical Snapshots)
It ships a Multi-Agent architecture, Fleet View, FHS compliant paths and
native systemd integration.
Designed for SREs and Forensic Analysts.</description>
  <packager></packager>
  <url>https://github.com/mariosergiosl/sys-inspector</url>
  <time file="1786974392" build="1786974390"/>
  <size package="6554460" installed="6548783" archive="6549180"/>
  <location href="src/sys-inspector-1.0.1-15.1.src.rpm"/>
  <format>
    <rpm:license>AGPL-3.0-only</rpm:license>
    <rpm:vendor>obs://build.opensuse.org/home:mariosergiosl:sys-inspector</rpm:vendor>
    <rpm:group>System/Monitoring</rpm:group>
    <rpm:buildhost>h02-ch1c</rpm:buildhost>
    <rpm:sourcerpm></rpm:sourcerpm>
    <rpm:header-range start="4504" end="9572"/>
    <rpm:requires>
      <rpm:entry name="fdupes"/>
      <rpm:entry name="python3-devel"/>
      <rpm:entry name="python3-setuptools"/>
      <rpm:entry name="systemd-rpm-macros"/>
    </rpm:requires>
  </format>
</package>
<package type="rpm">
  <name>sys-inspector-agent</name>
  <arch>noarch</arch>
  <version epoch="0" ver="1.0.1" rel="15.1"/>
  <checksum type="sha256" pkgid="YES">c78753131115bc0e3ac9e1767d2cbc2230d28ff8e275e57b40be1b8a985fb2a3</checksum>
  <summary>Sys-Inspector collection agent (eBPF)</summary>
  <description>Collection side of Sys-Inspector: attaches eBPF probes and captures process,
file and network activity on the inspected host.

Installs no web server. The host under investigation should carry only what the
collection itself requires, so that the tool does not add attack surface to the
very machine it is there to examine.

Captures are encrypted with the analyst public key before touching disk, and the
agent never holds the private key: a compromised host cannot read what has
already been collected on it.</description>
  <packager></packager>
  <url>https://github.com/mariosergiosl/sys-inspector</url>
  <time file="1786974393" build="1786974390"/>
  <size package="9440" installed="0" archive="124"/>
  <location href="noarch/sys-inspector-agent-1.0.1-15.1.noarch.rpm"/>
  <format>
    <rpm:license>AGPL-3.0-only</rpm:license>
    <rpm:vendor>obs://build.opensuse.org/home:mariosergiosl:sys-inspector</rpm:vendor>
    <rpm:group>System/Monitoring</rpm:group>
    <rpm:buildhost>h02-ch1c</rpm:buildhost>
    <rpm:sourcerpm>sys-inspector-1.0.1-15.1.src.rpm</rpm:sourcerpm>
    <rpm:header-range start="4504" end="9324"/>
    <rpm:provides>
      <rpm:entry name="sys-inspector-agent" flags="EQ" epoch="0" ver="1.0.1" rel="15.1"/>
    </rpm:provides>
    <rpm:requires>
      <rpm:entry name="binutils"/>
      <rpm:entry name="kernel-devel"/>
      <rpm:entry name="python3-bcc"/>
      <rpm:entry name="sys-inspector" flags="EQ" epoch="0" ver="1.0.1" rel="15.1"/>
    </rpm:requires>
    <rpm:recommends>
      <rpm:entry name="sys-inspector-scenarios" flags="EQ" epoch="0" ver="1.0.1" rel="15.1"/>
    </rpm:recommends>
  </format>
</package>
<package type="rpm">
  <name>sys-inspector-scenarios</name>
  <arch>noarch</arch>
  <version epoch="0" ver="1.0.1" rel="15.1"/>
  <checksum type="sha256" pkgid="YES">59c3d5fd6de25ba6dce3f6907b5cec062ec1d5fe125767e0fc7fd4e866c588de</checksum>
  <summary>Sys-Inspector detection test scenarios (laboratory only)</summary>
  <description>Test scenarios used to verify that detection actually works, by generating the
observable behaviour of known techniques and checking that the capture sees it.

LABORATORY USE ONLY. These scenarios create files, processes and network noise
on the machine where they run, and are meant for calibration on hosts dedicated
to that purpose, never on a system under investigation or in service.

They act only on the local host.
There is no network scanning, no remote exploitation, and
no functional exploit code: what is reproduced is the observable behaviour of a
technique, not a weapon. Everything created is removed afterwards.

The purpose is to prove the detection works, which is why the expected signal of
each scenario is declared alongside it.</description>
  <packager></packager>
  <url>https://github.com/mariosergiosl/sys-inspector</url>
  <time file="1786974393" build="1786974390"/>
  <size package="19196" installed="26793" archive="27908"/>
  <location href="noarch/sys-inspector-scenarios-1.0.1-15.1.noarch.rpm"/>
  <format>
    <rpm:license>AGPL-3.0-only</rpm:license>
    <rpm:vendor>obs://build.opensuse.org/home:mariosergiosl:sys-inspector</rpm:vendor>
    <rpm:group>System/Monitoring</rpm:group>
    <rpm:buildhost>h02-ch1c</rpm:buildhost>
    <rpm:sourcerpm>sys-inspector-1.0.1-15.1.src.rpm</rpm:sourcerpm>
    <rpm:header-range start="4504" end="10804"/>
    <rpm:provides>
      <rpm:entry name="config(sys-inspector-scenarios)" flags="EQ" epoch="0" ver="1.0.1" rel="15.1"/>
      <rpm:entry name="sys-inspector-scenarios" flags="EQ" epoch="0" ver="1.0.1" rel="15.1"/>
    </rpm:provides>
    <rpm:requires>
      <rpm:entry name="/bin/bash"/>
      <rpm:entry name="sys-inspector" flags="EQ" epoch="0" ver="1.0.1" rel="15.1"/>
    </rpm:requires>
    <file type="dir">/etc/sys-inspector</file>
    <file>/etc/sys-inspector/config.yaml</file>
    <file>/usr/bin/chaos_maker.sh</file>
  </format>
</package>
<package type="rpm">
  <name>sys-inspector-server</name>
  <arch>noarch</arch>
  <version epoch="0" ver="1.0.1" rel="15.1"/>
  <checksum type="sha256" pkgid="YES">71d40ee2bafe3d4f4adc026f6c3a6320289edc63d7568b5c7df66784327ff131</checksum>
  <summary>Sys-Inspector central server (fleet, ingestion, reports)</summary>
  <description>Server side of Sys-Inspector: receives captures from the fleet, stores them and
renders the forensic reports.

Requires no eBPF and no kernel headers. The server never opens a connection to
an agent; agents ask and write, which is what allows the inspected host to keep
no listening service.</description>
  <packager></packager>
  <url>https://github.com/mariosergiosl/sys-inspector</url>
  <time file="1786974393" build="1786974390"/>
  <size package="9124" installed="0" archive="124"/>
  <location href="noarch/sys-inspector-server-1.0.1-15.1.noarch.rpm"/>
  <format>
    <rpm:license>AGPL-3.0-only</rpm:license>
    <rpm:vendor>obs://build.opensuse.org/home:mariosergiosl:sys-inspector</rpm:vendor>
    <rpm:group>System/Monitoring</rpm:group>
    <rpm:buildhost>h02-ch1c</rpm:buildhost>
    <rpm:sourcerpm>sys-inspector-1.0.1-15.1.src.rpm</rpm:sourcerpm>
    <rpm:header-range start="4504" end="9008"/>
    <rpm:provides>
      <rpm:entry name="sys-inspector-server" flags="EQ" epoch="0" ver="1.0.1" rel="15.1"/>
    </rpm:provides>
    <rpm:requires>
      <rpm:entry name="python3-Flask"/>
      <rpm:entry name="sys-inspector" flags="EQ" epoch="0" ver="1.0.1" rel="15.1"/>
    </rpm:requires>
  </format>
</package>
</metadata>