Antemure

Antemure is an Autonomous Security Remediation Platform (ASRP) — a self-healing endpoint security control plane that runs a continuous detect → reason → remediate → verify loop on every host and coordinates it across the fleet. Deterministic detection always runs; an LLM investigates and plans fixes; a constrained, self-protecting tool layer carries them out and proves the threat is gone.

Antemure ships as four cooperating binaries and three operator consoles. The fastest way to see a full loop is the Getting Started guide: install a daemon and a hub, enroll the node, and trigger the built-in safe test incident.

What Antemure is

Antemure protects endpoints with an autonomous agent rather than a rules-only sensor. On each host a lightweight daemon observes the system through a bank of collectors, scores every change with a deterministic, MITRE ATT&CK–mapped detection engine, escalates anything suspicious to an AI investigation, and — when policy allows — remediates and then verifies on disk that the threat is actually gone. A fleet hub aggregates every node, learns from each incident, and immunizes the rest of the fleet.

The same pipeline runs through two lenses. The Cyber lens is the security story above. The SRE lens turns the same telemetry, fleet-config push and gated executor toward reliability — SLOs, metric alerts, correlation alerts, scheduled runbooks and inbound webhooks, with recovery actions (restart / reload / reprovision) and AI post-mortems. Flip the Cyber/SRE switch in either console; see Reliability & SRE.

Three design commitments shape everything:

  • Deterministic first. Detection rules, the policy engine and collectors always score. The LLM augments judgement but is never required — an unlicensed or air-gapped node with no gateway still detects and reasons heuristically.
  • Safe by construction. Remediation runs behind an action allowlist, a hard self-protection guard, operator-lockout and forbidden-command checks, and automatic rollback on failed verification. Autonomy is off by default (the Watch tier).
  • Sovereign. Point the reasoning at the hosted gateway or at your own OpenAI-compatible model; export telemetry to your SIEM; keep data on your infrastructure.

The pieces

ComponentBinaryDefault portRole
Endpoint daemonantemure-daemon18900 (TLS admission 8443)The per-host agent: collectors → reasoning → remediation, local console/API, dials the hub.
Fleet hubantemure-hub18901Fleet control plane and dashboard; aggregates nodes, runs fleet immunity and the knowledge graph, terminates the reverse relay.
SOAR engineantemure-soar18902Durable playbook worker + internal API (Temporal workflows over Postgres). Reached only through the hub.
MCP serverantemure-mcp18902Exposes every hub action as Model Context Protocol tools so an AI agent (e.g. Claude) can operate the fleet under the same RBAC.

The daemon and hub are the whole product for most deployments; SOAR and MCP are additive. antemure-soar and antemure-mcp share the default port 18902 and are not meant to run on the same host with defaults.

The autonomous loop

Every cycle on a node runs the same sequence (it is event-driven — a filesystem/audit watcher wakes it within ~750 ms of a change — with a 30 s heartbeat as a backstop):

  1. Observe. All enabled collectors poll; events persist to a local SQLite store and update an in-memory entity graph.
  2. Reason. A deterministic heuristic scores first (detection rules set a risk floor). If the score crosses the incident threshold and the gateway is reachable, a fan-out of AI investigators examines the evidence from five angles and a synthesizer returns one verdict with proposed actions.
  3. Remediate. Gated by the node's risk tier and per-incident authorization (or standing fleet autonomy), the agent executes a plan — contain, then neutralize, then clean up — through the constrained tool layer.
  4. Verify. The agent re-checks ground truth (process dead, file gone) before trusting any “done,” rolls back on failure, and only then closes the incident.

See Architecture for the full cycle, the entity model, and how nodes and the hub exchange data.

Consoles

  • Fleet Console (hub, :18901) — the fleet-wide control center: heat map, incidents, approvals, SOAR, integrations, knowledge graph, vault, administration and settings, plus an operator AI analyst copilot.
  • Endpoint Console (daemon, :18900) — one machine's live detect/reason/remediate loop, incident records, telemetry and a safe “Simulate attack” button.
  • SOAR Builder (served by the hub at /soar-builder/) — a visual, drag-and-drop playbook designer embedded in the dashboard.

Where to go next