Fleet
Managed endpoints, health and agent versions
| Hostname | IP | Version | Score | Mode | Status | Last seen | Alerts |
|---|
🔑 Manage Agents — Invitation Tokens
Vytvořte pojmenovaného agenta a získejte jednorázový token pro jeho registraci. Token se po vytvoření zobrazí jen jednou.
Jak připojit agenta
# 1. Nainstalujte Citadel agenta curl -sSL https://get.aegiscitadel.ai | bash # 2. Spusťte s vygenerovaným tokenem citadel-agent run --fleet-token <token> # 3. Ověřte v dashboardu → Fleet
Live Alert Stream
Real-time alerts from agents (socket backlog + push)
Incidents
Triage queue with MITRE mapping and response actions
| Time | Host | Rule | Tactic | Status |
|---|
Threat Hunt
Search across alerts, incidents, network peers and IOCs (last 7 days)
| Source | Host | Detail | Time |
|---|
Provenance
Attack Story Graph — causal chain, Mermaid/JSON export, contain subgraph
Rewind Studio
Time Machine for the server — dry-run preview, rewind to tip & ephemeral OverlayFS
Incident Causal Rewind
⚡ Zero-Cost Ephemeral Live Rewind (ext4 / XFS)
Okamžitý ransomware rollback (< 1 ms) zahozením copy-up vrstvy bez závislosti na Btrfs/ZFS CoW podpoře.
| Session ID | Chráněný adresář (Lowerdir) | Zapisovatelná vrstva (Upperdir) | Stav | Vytvořeno | Akce |
|---|
IOCs & Fleet Immunity
Real-time cross-fleet herd immunization & enforced threat intelligence
🛡️ Active Cross-Fleet Antibodies (Herd Immunity)
Real-time threat antibodies generated across fleet servers & relayed via Cloud to eBPF/LSM kernel filters.
| Kind | Threat Target (IOC) | Source Server | Created | Expires in | Status | Actions |
|---|
Static IOC Catalog
Manually defined indicators of compromise pushed into signed fleet rules.
| Type | Value | Note | Enforce |
|---|
Network
Fleet peers and outbound destinations enriched with AbuseIP reputation
IP reputation
Egress / C2 destinations observed by agents (cached AbuseIP lookups).
| IP | Verdict | Score | Country | ISP | Domain | Reports | Seen by |
|---|
Peers
LAN / mesh peers reported in agent metrics.
| IP | MAC | Reputation | Sources | Seen by | Status |
|---|
Aegis
Autonomous defense on the host selected in the top bar
MITRE ATT&CK Coverage
Recent alerts on this host
| When | Kind | Action | Process |
|---|
💉 Live eBPF Virtual Hotpatching
Zero-downtime KEV immunization & syscall-level exploit filtering in kernel (< 10 µs)
🧪 Live Exploit Sandbox Tester
Otestujte příkaz nebo síťový payload vůči aktivním eBPF KEV pravidlům bez rizika kompromitace.
| CVE ID | Exploit Název & Popis | Subsystém | Target vzor | Obranná akce | Zásahy | Stav |
|---|
AI Fleet Personas
Behavioral clustering of hosts and anomaly detection
Clusters
Anomalies
NIS2 & DORA Compliance
Cryptographic proof of regulatory compliance, audit hash-chain, and fleet security posture
1. European Directives Compliance Mapping (NIS2 & DORA)
Status is derived from measurements reported by hosts in scope — not asserted. Articles with no measurable evidence are shown as Not measured.
| Directive Article | Mechanism & measured evidence | Status |
|---|---|---|
| Loading… | ||
2. Fleet Server Evidence Inventory
Real-time inventory and cryptographic audit integrity across all endpoints within the tenant scope
| Hostname | IP Address | Agent Version | Defense Mode | eBPF / exec lockdown | Audit Hash-Chain | Config | Vulns | Exposed | Status |
|---|---|---|---|---|---|---|---|---|---|
| Loading server inventory… | |||||||||
3. Configuration Findings (Evidence)
Failed hardening checks with what was measured and how to fix it. Passing checks are counted in the summary above, not listed here.
| Severity | Host | Check | Measured | Remediation | NIS2 |
|---|---|---|---|---|---|
| Loading… | |||||
4. Cryptographic Signature & Non-Repudiation Proof
Ed25519 signature over the canonical payload, produced by the Fleet Console signing key.
Subscription
Choose the right plan for your fleet. Secure payment via Stripe Checkout.
Feature Comparison Matrix
Complete breakdown of security capabilities, threat intelligence, and compliance across plans
| Security Capabilities | Free | Team | Business Popular | Scale | Enterprise |
|---|---|---|---|---|---|
| ⚡ Core Protection & eBPF Defense | |||||
| Protected Linux Servers | 1 | Up to 5 | Up to 10 | Up to 25 | 50+ |
| eBPF Kernel Defense (LSM & Syscall hooks) | ✅ | ✅ | ✅ | ✅ | ✅ |
| Local Behavioral Anomaly Detection & Baseline | ✅ | ✅ | ✅ | ✅ | ✅ |
| Zero-Day Memory Scanner (PROT_EXEC Entropy & Anti-ROP) | Basic Scan | ✅ Stratified | ✅ Stratified + LLM | ✅ | ✅ |
| Quantum-Resistant VQC DGA Classifier (DNS Fast-Flux) | Shannon Filter | Heuristics | ✅ Full VQC Engine | ✅ | ✅ |
| Instant File Rewind & Ransomware Rollback | ✅ | ✅ | ✅ | ✅ | ✅ |
| 🛡️ Antivirus & Threat Intelligence | |||||
| Malware Hash Reputation (SHA-256 Check & Caching) | 🔒 Locked | ✅ Live HashDB | ✅ Live HashDB | ✅ | ✅ |
| Outbound IP & C2 Blocker (AbuseIPDB Threat Intel) | 🔒 Locked | ✅ Active Blocker | ✅ Active Blocker | ✅ | ✅ |
| Parallel High-Speed Hash Sweeps (JoinSet) | — | — | ✅ | ✅ | ✅ |
| Custom IOC Feeds & Fleet Firewall Rules | — | — | — | ✅ | ✅ |
| 🤖 Autonomous AI & Forensics | |||||
| Autonomous Aegis Kill & Network Containment | — | ✅ | ✅ | ✅ | ✅ |
| AI Attack Explanations (LLM Incident Narrative) | — | — | ✅ | ✅ | ✅ |
| Forensic Incident Timeline & Process Tree | 24 Hours | 7 Days | 30 Days | 90 Days | 1 Year / Custom |
| Instant Email Alert Notifications | — | ✅ | ✅ | ✅ | ✅ |
| 👥 Fleet Management & Compliance | |||||
| Multi-User Team Access & Roles (RBAC) | — | — | ✅ | ✅ | ✅ |
| NIS2 & DORA Signed Compliance Reports | — | — | ✅ | ✅ | ✅ |
| Full REST API & Webhook Ingest (SIEM/SOAR) | — | — | — | ✅ | ✅ |
| Single Sign-On (SSO / SAML / Google Workspace) | — | — | — | — | ✅ |
| Technical Support SLA | Community | Email (24h) | Priority (8h) | Urgent (4h) | Dedicated 24/7 |
Users
Manage per-tenant user accounts and roles
Settings
Fleet policy, notifications and console administration
Signed block/allow lists distributed to every agent (block_ips, block_paths, block_domains + exclusions allow_hashes, allow_exec, allow_shadow_paths, allow_comms). Saving bumps the policy version. IOCs live under Investigate → IOCs.