DarkAegis

DarkAegis EDR // Built for Linux servers

Behavioral Linux security under your control

DarkAegis is being built as a Linux-native, local-first endpoint detection and response platform. Connect observed behavior to understandable findings, investigate on the host or across a fleet, and keep security data and response decisions under your control.

Explore the approach Discuss an evaluation

Pre-alpha In development · Not production-ready

  • Behavioral contextUnderstand related activity
  • Local independenceKeep the host useful on its own
  • Operator authorityChoose disclosure and response

Make security observations useful to the people running Linux

An alert is a starting point. Operators need process context, supporting observations, and a clear basis for deciding what warrants attention. DarkAegis is built around that workflow.

  • Behavior in context

    Connect related observations

    Review observed process relationships alongside network, filesystem, privilege, and memory-metadata activity. Assess the available context around a finding, not just an isolated indicator.

  • Local-first operation

    Investigate directly on the host

    Core monitoring and rule-backed alerts run locally. The terminal console provides access to alerts, process context, and agent health without a mandatory dashboard connection.

  • Explainable findings

    Inspect the basis for an alert

    Examine rule context, cited events, confidence, and risk contributions. Findings support an investigation; they do not automatically establish malicious intent.

  • Deliberate privacy

    Separate collection from disclosure

    Local monitoring and off-host disclosure are different decisions. Privacy-preserving defaults and an explicitly defined export scope keep that distinction part of the design.

  • Operator-controlled response

    Authorize actions deliberately

    Inspect the target, confirm the action, and review its recorded outcome. Response authority is separate from an alert's severity or a dashboard review decision.

  • Optional fleet visibility

    Extend the view across servers

    The optional commercial dashboard brings retained, explicitly exported evidence into fleet search and investigation without becoming a dependency for core local detection.

Observe the events and assess the evidence

Review which observations support a finding, how they are related, and which context is unavailable. DarkAegis emphasizes the distinction between observed facts, supported correlations, and conclusions that still require investigation.

Which process launched this shell?
Review observed ancestry, execution, and privilege context associated with unexpected shell activity.
Which processes communicated with this address?
Search retained network observations and pivot into the related host and process investigation.
Which observations support this finding?
Inspect readable event summaries and available source records alongside the rule's reasoning and evidence limits.

Start with a local agent and add fleet operations when useful

A Linux server should remain observable when a management service is unavailable. DarkAegis keeps the standalone agent useful while offering a separate fleet workflow for teams managing multiple hosts.

Standalone agent

Local monitoring and investigation

Use dactl and its terminal console to inspect local alerts, process context, retained alert detail, and collector health. Core detection does not require the commercial dashboard.

Optional commercial dashboard

Fleet search and investigation

Review enrolled hosts, search retained events with Hunt, inspect process relationships, and manage supported per-host settings through authenticated fleet operations.

The product model pairs a source-available standalone agent with optional commercial fleet tools. Permitted non-commercial use and commercial deployment follow their respective license terms.

Keep disclosure a deliberate choice

Collection, retention, and remote disclosure serve different purposes. DarkAegis is designed to keep those boundaries explicit, with a defined telemetry scope and authenticated, encrypted transport for fleet operations.

Minimized telemetry can still contain sensitive paths and network endpoints. Supported disclosure choices depend on the available host configuration; broader field-level overrides remain in development.

Keep response decisions with the operator

An alert is not permission to change a host. Operator-authorized response checks the live target, requires a reason and confirmation, and records the requested action separately from the observed outcome.

Current process response is opt-in, single-process SIGTERM. Signal acknowledgement is not confirmed exit. Automatic containment and broad malware prevention are not available.

Follow the development of DarkAegis

Read project milestones, technical notes, and progress toward a public release.

Read development updates

Help shape Linux security around your operational needs

Linux administrator, security engineer, or infrastructure operator? Discuss the evidence you need, the data that must stay local, and the response boundaries that matter to your team. Start a conversation about a controlled evaluation.

Discuss an evaluation