Home

Aegis v2 documentation

These pages describe v0.2 (currently v0.2.3). Where a page mentions something later releases will add, it says so and links to the roadmap.

Getting started

• Overview: what Aegis is, and the words the rest of the docs use.
• Installation: install the RPMs, start the daemon, remove it again.
• Preflight: every host check aegisctl preflight runs, and how to fix each one.

Running it

• Configuration: every setting in /etc/aegis-v2/config.toml and the allowlist drop-ins.
• Scoring: the weights, decay, thresholds, and how to baseline a host in audit mode.
• Incidents: what an incident is, where it lives, and how to read one.
• Telemetry: the journald, JSON-lines and OTLP outputs, field by field.
• aegisctl: every command, flag and exit code.
• SELinux: the aegisd_t domain and its one boolean.

Knowing its limits

• Threat model: what Aegis sees, what it can't, and the known gaps.
• Troubleshooting: symptoms and fixes.
• FAQ: short answers to common questions.

Working on Aegis

• Architecture: the crates, probes and pipeline.
• Development: building, testing, the e2e harness.
• Releasing: versioning and cutting a release.
• Roadmap: what's planned for v0.2.0 and later.

---

From docs/README.md at v0.2.3.