============================================================ SHiRE SENTINEL ALERT BRIDGE RECOVERY REPORT ============================================================ Generated: 2026-08-06T17:16:12+08:00 Hostname: Work User: ray Bridge service: shire-sentinel-alert.service Bridge script: /usr/local/lib/shire-sentinel/alert_bridge.py Configuration: /etc/shire-sentinel/alert-bridge.json SHiREVault: /mnt/shirevault-network //192.168.1.1/volume(sda2) cifs === SERVICE STATE BEFORE RECOVERY === shire-sentinel-suricata.service enabled=enabled active=active shire-sentinel-alert.service enabled=enabled active=inactive tailscaled.service enabled=enabled active=active shire-mobile-gateway.service enabled=enabled active=active === ALERT BRIDGE SYSTEMD DETAILS === Type=simple MainPID=0 Result=success NRestarts=0 ExecMainCode=0 ExecMainStatus=0 ExecStart={ path=/usr/bin/python3 ; argv[]=/usr/bin/python3 /usr/local/lib/shire-sentinel/alert_bridge.py --config /etc/shire-sentinel/alert-bridge.json ; ignore_errors=no ; start_time=[n/a] ; stop_time=[n/a] ; pid=0 ; code=(null) ; status=0/0 } WorkingDirectory= User=root Group=root LoadState=loaded ActiveState=inactive SubState=dead FragmentPath=/etc/systemd/system/shire-sentinel-alert.service UnitFileState=enabled === ALERT BRIDGE UNIT FILE === # /etc/systemd/system/shire-sentinel-alert.service [Unit] Description=SHiRE Sentinel Live Threat Alert Bridge Requires=shire-sentinel-suricata.service After=shire-sentinel-suricata.service graphical.target [Service] Type=simple User=root Group=root ExecStart=/usr/bin/python3 /usr/local/lib/shire-sentinel/alert_bridge.py --config /etc/shire-sentinel/alert-bridge.json Restart=always RestartSec=3 TimeoutStopSec=20 NoNewPrivileges=true PrivateTmp=true PrivateDevices=true ProtectSystem=strict ProtectHome=read-only ProtectKernelTunables=true ProtectKernelModules=true ProtectControlGroups=true ProtectClock=true RestrictSUIDSGID=true LockPersonality=true MemoryDenyWriteExecute=true ReadOnlyPaths=/var/log/suricata/shire-sentinel ReadWritePaths=/var/lib/shire-sentinel-alert /home/shire3d/ARMOR/data/sentinel [Install] WantedBy=multi-user.target === FILE IDENTITY === FILE: /usr/local/lib/shire-sentinel/alert_bridge.py OWNER: root:root MODE: -rwxr-xr-x (755) SIZE: 15752 bytes MODIFIED: 2026-08-02 08:01:55.956715957 +0800 FILE: /etc/shire-sentinel/alert-bridge.json OWNER: root:root MODE: -rw-r--r-- (644) SIZE: 772 bytes MODIFIED: 2026-08-02 08:01:55.966684263 +0800 ffa81f070306dc446c15bf4b034e724f2b8dd5a630be62eaee72d24e53041de2 /usr/local/lib/shire-sentinel/alert_bridge.py 598fc535cb25b2ba9450d2273fb4b69d33f46e2a9ab96472b90032afc9a76013 /etc/shire-sentinel/alert-bridge.json === IN-MEMORY PYTHON VALIDATION === PASS: Alert bridge Python source compiled in memory. No Python bytecode or source files were written. === REDACTED CONFIGURATION VALIDATION === PASS: Alert bridge configuration is valid JSON. { "dedupe_seconds": 1800, "display": ":0", "eve_log": "/var/log/suricata/shire-sentinel/eve.json", "feed_file": "/home/shire3d/ARMOR/data/sentinel/alerts.jsonl", "important_keywords": "", "latest_file": "/home/shire3d/ARMOR/data/sentinel/latest_alert.json", "maximum_notification_severity": 2, "maximum_notifications_per_window": 5, "notify_uid": 1000, "notify_user": "ray", "rate_limit_window_seconds": 300, "state_file": "/var/lib/shire-sentinel-alert/state.json", "status_file": "/home/shire3d/ARMOR/data/sentinel/alert_bridge_status.json" } === SENTINEL DATA FILES === --- /home/shire3d/ARMOR/data/sentinel/alerts.jsonl --- OWNER: ray:ray MODE: -rw-r----- (640) SIZE: 4406 bytes MODIFIED: 2026-08-06 10:09:15.294988792 +0800 Lines: 10 --- /home/shire3d/ARMOR/data/sentinel/latest_alert.json --- OWNER: ray:ray MODE: -rw-r----- (640) SIZE: 452 bytes MODIFIED: 2026-08-06 10:09:15.297519883 +0800 Lines: 17 --- /home/shire3d/ARMOR/data/sentinel/alert_bridge_status.json --- OWNER: ray:ray MODE: -rw-r----- (640) SIZE: 634 bytes MODIFIED: 2026-08-06 10:09:15.298989042 +0800 Lines: 22 --- /var/log/suricata/shire-sentinel/eve.json --- MISSING === CURRENT BRIDGE STATUS === { "updated_at": "2026-08-06T02:09:15.298947+00:00", "running": true, "watching": "/var/log/suricata/shire-sentinel/eve.json", "last_alert": { "received_at": "2026-08-06T02:09:15.295504+00:00", "source": "suricata", "self_test": true, "severity": 1, "severity_label": "CRITICAL", "signature_id": 9999999, "signature": "SHiRE Sentinel alert delivery self-test", "category": "Harmless local test", "action": "allowed", "src_ip": "192.0.2.10", "dest_ip": "192.0.2.20", "dest_port": 443, "protocol": "TCP", "delivery": "desktop-popup", "notification_allowed": true } } === RECENT ALERT FEED SAMPLE === {"received_at": "2026-08-03T18:46:27.308026+00:00", "source": "suricata", "self_test": false, "severity": 2, "severity_label": "HIGH", "signature_id": 2019102, "signature": "ET DOS Possible SSDP Amplification Scan in Progress", "category": "Attempted Denial of Service", "action": "allowed", "src_ip": "192.168.1.144", "dest_ip": "192.168.1.1", "dest_port": 1900, "protocol": "UDP", "delivery": "terminal-broadcast", "notification_allowed": true} {"received_at": "2026-08-04T12:26:23.675990+00:00", "source": "suricata", "self_test": false, "severity": 2, "severity_label": "HIGH", "signature_id": 2019102, "signature": "ET DOS Possible SSDP Amplification Scan in Progress", "category": "Attempted Denial of Service", "action": "allowed", "src_ip": "192.168.1.144", "dest_ip": "192.168.1.1", "dest_port": 1900, "protocol": "UDP", "delivery": "terminal-broadcast", "notification_allowed": true} {"received_at": "2026-08-05T04:05:26.398137+00:00", "source": "suricata", "self_test": false, "severity": 2, "severity_label": "HIGH", "signature_id": 2027203, "signature": "ET INFO Possible Powershell .ps1 Script Use Over SMB", "category": "Potentially Bad Traffic", "action": "allowed", "src_ip": "192.168.1.144", "dest_ip": "192.168.1.1", "dest_port": 445, "protocol": "TCP", "delivery": "terminal-broadcast", "notification_allowed": true} {"received_at": "2026-08-05T09:21:22.840248+00:00", "source": "suricata", "self_test": false, "severity": 2, "severity_label": "HIGH", "signature_id": 2027206, "signature": "ET INFO Possible WMI .mof Managed Object File Use Over SMB", "category": "Potentially Bad Traffic", "action": "allowed", "src_ip": "192.168.1.144", "dest_ip": "192.168.1.1", "dest_port": 445, "protocol": "TCP", "delivery": "terminal-broadcast", "notification_allowed": true} {"received_at": "2026-08-06T02:09:15.295504+00:00", "source": "suricata", "self_test": true, "severity": 1, "severity_label": "CRITICAL", "signature_id": 9999999, "signature": "SHiRE Sentinel alert delivery self-test", "category": "Harmless local test", "action": "allowed", "src_ip": "192.0.2.10", "dest_ip": "192.0.2.20", "dest_port": 443, "protocol": "TCP", "delivery": "desktop-popup", "notification_allowed": true} === JOURNAL BEFORE RECOVERY === Aug 06 16:51:13 Work systemd[1]: shire-sentinel-alert.service: Found ordering cycle on multi-user.target/stop Aug 06 16:51:13 Work systemd[1]: shire-sentinel-alert.service: Found dependency on graphical.target/stop Aug 06 16:51:13 Work systemd[1]: shire-sentinel-alert.service: Found dependency on shire-sentinel-alert.service/stop Aug 06 16:51:13 Work systemd[1]: shire-sentinel-alert.service: Job multi-user.target/stop deleted to break ordering cycle starting with shire-sentinel-alert.service/stop Aug 06 16:51:13 Work systemd[1]: Stopping shire-sentinel-alert.service - SHiRE Sentinel Live Threat Alert Bridge... Aug 06 16:51:14 Work systemd[1]: shire-sentinel-alert.service: Deactivated successfully. Aug 06 16:51:14 Work systemd[1]: Stopped shire-sentinel-alert.service - SHiRE Sentinel Live Threat Alert Bridge. Aug 06 16:51:14 Work systemd[1]: shire-sentinel-alert.service: Consumed 22min 53.599s CPU time, 64.8M memory peak, 1.3M memory swap peak. === CONTROLLED SERVICE RECOVERY === Alert bridge became active after 1 second(s). PASS: Alert bridge service is active. === LIVE PROCESS === PID PPID USER GROUP COMMAND ELAPSED %CPU %MEM COMMAND 8810 1 root root python3 00:00 66.6 0.0 /usr/bin/python3 /usr/local/lib/shire-sentinel/alert_bridge.py --config /etc/shire-sentinel/alert-bridge.json === JOURNAL AFTER RECOVERY === Aug 06 17:16:12 Work systemd[1]: Started shire-sentinel-alert.service - SHiRE Sentinel Live Threat Alert Bridge. === BRIDGE STATUS AFTER RECOVERY === MODIFIED: 2026-08-06 17:16:12.866692656 +0800 SIZE: 201 bytes { "updated_at": "2026-08-06T09:16:12.866549+00:00", "running": true, "watching": "/var/log/suricata/shire-sentinel/eve.json", "state": "watching", "inode": 11674715, "offset": 2981957965 } === FINAL SECURITY SERVICE CHECK === shire-sentinel-suricata.service enabled=enabled active=active shire-sentinel-alert.service enabled=enabled active=active tailscaled.service enabled=enabled active=active shire-mobile-gateway.service enabled=enabled active=active === RECOVERY RESULT === PASS: SENTiNEL alert bridge is active. PASS: Suricata remains active. PASS: Tailscale and the mobile gateway remain active. PASS: UFW remains active. PASS: No Android source or APK was changed. PASS: No router, DNS or public-port setting was changed.