Configuration

The daemon reads a single YAML file (default ~/.antemure/config.yaml), overlaid by AURA_* environment variables, then by CLI flags, with the hub's fleet-managed config authoritative for managed nodes. Every section carries defaults, so a partial file is valid.

Precedence

Highest wins: CLI flags → AURA_* environment → YAML file → built-in defaults. For a managed node, the fleet-managed config pulled from the hub overrides the subset it covers, live, regardless of file or env. Every environment key is prefixed AURA_ (not ANTEMURE_).

Top-level keys

Key	Default	Purpose
`node_id`	hostname	Node identity (env `AURA_NODE_ID`, flag `--node`).
`db_path`	`~/.antemure/antemure.db`	Local SQLite store.
`web_port`	`18900`	Daemon console/API port.
`risk_tier`	`watch`	Enforcement gate: `watch\|low\|medium\|high\|critical`.
`hub_url`	none	Hub(s) to poll — comma-separated for HA failover.
`license_key`	none	Access8 key `cp_…` (or `~/.antemure/license.key`).
`access8_url`	`control.secureinsights.ai`	Licensing / update control plane.
`alert_webhook_url`	none	Slack-compatible per-incident webhook.
`telemetry_enabled`, `cloud_url`	false / none	Optional cloud uplink for fleet learning.

`collectors`

All collector toggles default on; poll_secs defaults to 30. Path roots are OS-aware and ~-expanded.

collectors:
  processes: true
  files: true
  network: true
  persistence: true
  services: true
  configuration: true
  credentials: true      # licensed
  ai_agents: true        # licensed
  logs: true
  audit: true            # Linux auditd
  etw: true              # Windows Sysmon/ETW
  containers: true
  poll_secs: 30
  watch_roots:   [/tmp, /var/tmp, ~/Downloads, ...]   # dropped-file watch
  config_roots:  [/etc, /etc/ssh, /etc/sudoers.d, ...] # file-integrity monitoring
  protect_roots: [~/Documents, ~/Desktop, ~/Pictures] # ransomware canaries

`reasoning` & `llm`

reasoning:
  incident_risk_threshold: 0.6   # score above which an event becomes an incident
  max_fanout: 4                  # parallel investigators
  daily_token_budget: 10000000   # 0 = unlimited  (AURA_DAILY_TOKEN_BUDGET)
  gateway_max_calls_per_min: 240
  context_events: 50
  default_interval_secs: 300

llm:
  provider: aura-gateway         # or custom/byok  (AURA_LLM_PROVIDER)
  base_url: https://gateway.secureinsights.ai   # AURA_LLM_BASE_URL
  model: auto                    # AURA_LLM_MODEL
  investigator_model: auto:simple
  agent_model: auto:reasoning
  api_key_env: AURA_GATEWAY_TOKEN   # bearer env var name; empty = use license key
  temperature: 0.2
  max_tokens: 2048

`remediation`

remediation:
  allowed_actions: [kill_process, quarantine_file, block_network, ...]  # allowlist
  approval_actions: [kill_process, disable_service, block_network,
                     isolate_host, quarantine_file, remove_persistence,
                     cloud_isolate_instance, cloud_stop_instance, cloud_disable_key]
  quarantine_dir: ~/.antemure/quarantine
  max_actions_per_incident: 10
  rollback_on_verify_fail: true
  protected_services: []   # never remediated (operator-declared)
  protected_paths: []      # never quarantined/removed (operator-declared)

See Investigation & Remediation for how the allowlist, approval gate and guards interact.

`retention`, `siem`, `archive`

retention:
  event_retention_days: 30     # 0 = keep forever
  incident_retention_days: 180
  audit_retention_days: 365
  vacuum_on_prune: true

siem:   { enabled: false, syslog_addr: "", syslog_protocol: udp,
          hec_url: "", hec_token: "", forward_events: false, forward_min_risk: 0.7 }
archive:{ enabled: false, bucket: "", region: us-east-1, prefix: antemure/telemetry,
          endpoint: "", access_key_id: "", secret_access_key: "",
          archive_after_days: 30, path_style: false }

Setting AURA_SIEM_SYSLOG/AURA_SIEM_HEC_URL auto-enables SIEM; setting AURA_S3_BUCKET auto-enables archive. Secrets are masked in config-returning APIs. See SIEM & Telemetry.

Environment variables

Common overrides (full inventory in the CLI reference): config fields map one-to-one — AURA_NODE_ID, AURA_WEB_PORT, AURA_RISK_TIER, AURA_HUB_URL, AURA_LICENSE_KEY, AURA_LLM_BASE_URL, AURA_GATEWAY_TOKEN, AURA_SIEM_*, AURA_S3_*, AURA_PROTECT_ROOTS, AURA_DAILY_TOKEN_BUDGET. Runtime: AURA_NODE_API_TOKEN (mutating-route bearer), AURA_BIND_ADDR (default 0.0.0.0), AURA_CORS_ORIGINS, AURA_HEARTBEAT_SECS (30), AURA_FLEET_POLL_SECS (300), AURA_VAULT_KEY (64-hex AES-256-GCM master key), RUST_LOG. Enrollment: AURA_ENROLL_URL, AURA_ENROLL_TOKEN, AURA_HUB_JOIN_TOKEN.

Fleet-managed overlay

For a managed node, the hub pushes (every AURA_FLEET_POLL_SECS) an overlay that overrides the local config live: model provider/models/BYOK key, remediation_behavior, risk_tier, autonomous_remediation, incident_risk_threshold, spend caps, retention days, the whole siem and archive blocks, license_state, and custom collectors/SLOs/alerts. Manage these from the dashboard's Administration → Fleet config and Settings — they are authoritative over the file and environment while the node is enrolled.

Configuration

Precedence

Top-level keys

collectors

reasoning & llm