Getting Started

This guide stands up an Antemure endpoint daemon and a fleet hub, connects them by enrollment, licenses the node and points the reasoning gateway, and triggers the built-in safe test incident so you can watch one full detect → reason → remediate → verify cycle.

What you need. One host for the hub (the fleet console) and one or more hosts for the daemon (the endpoints you protect). Optionally an Access8 license key (cp_…) and a reachable LLM gateway for the AI investigation (the default is gateway.secureinsights.ai; point it at any OpenAI-compatible endpoint for on-prem/air-gapped use).

1. Install

Pick the path that fits the target. All methods install the same binaries; full details and prerequisites are in Deployment & Ops.

Target	Method
macOS / Linux host (quickest)	the shell installer: `install.sh` (launchd on macOS, systemd on Linux)
Windows host	`install.ps1` (run as Administrator; NSSM service or Scheduled Task)
Linux servers at scale	native `.deb` / `.rpm` packages with systemd units
A single box, containerized	Docker Compose (`deploy/compose/`)
A Kubernetes cluster	Helm (umbrella chart) or the `AntemureCluster` operator — a DaemonSet sensor per node

The shell installer builds from source if a prebuilt binary is not present, places binaries in /usr/local/bin, writes a starter config to ~/.antemure/config.yaml, and registers a self-healing background service (on Linux it also installs a watchdog timer that restarts the daemon if it is killed).

2. Start the fleet hub

The hub is the fleet console and control plane. It listens on 18901 and keeps its state under ~/.antemure/.

antemure-hub --port 18901 \
  --endpoints ~/.antemure/endpoints.json \
  --fleet-config ~/.antemure/hub-fleet-config.json

curl -s http://localhost:18901/api/health      # {"status":"ok"}

Open http://your-hub:18901/. With no SSO configured the hub runs in open mode — every visitor is treated as an operator and a banner says so. That is fine for a first look on a trusted LAN; for anything real, configure WorkOS SSO and role mapping (see Tokens, Auth & RBAC). A first-run wizard walks you through securing the console, licensing, and enrolling nodes.

3. Enroll an endpoint

Endpoints self-enroll outbound-only — the node POSTs to the hub and holds an outbound relay, so no inbound port is needed (NAT-friendly). Get the hub URL and a join token from the dashboard's Fleet → Add a node page, then on the endpoint:

# one-liner (pulls the installer from the hub and enrolls)
curl -fsSL http://your-hub:18901/install.sh | sudo sh -s -- \
  --enroll http://your-hub:18901 --token <join-token> [--license cp_...]

# or, if already installed, set the env and (re)start the service:
#   AURA_ENROLL_URL=http://your-hub:18901
#   AURA_ENROLL_TOKEN=<join-token>

The daemon reads ~/.antemure/config.yaml and serves its own console/API on 18900. Confirm it is alive and that it appeared in the fleet:

curl -s http://localhost:18900/api/health       # on the endpoint
curl -s http://your-hub:18901/api/endpoints     # should list the node id

A fresh node starts in the Watch risk tier — it observes and reasons but takes no enforcement action. That is the correct posture for the first days of an evaluation. Raising the tier and enabling autonomy is covered in Investigation & Remediation.

4. License & the LLM gateway

The Access8 license key (cp_…) entitles licensed collectors and doubles as the bearer token for the hosted reasoning gateway. Set it on the node, or on the hub and let it flow to the fleet:

export AURA_LICENSE_KEY="cp_xxxxxxxxxxxxxxxx"
export AURA_ACCESS8_URL="https://control.secureinsights.ai"   # licensing / updates

To use your own model instead of the hosted gateway (required for air-gapped deployments), point the base URL at any OpenAI-compatible server (vLLM, Ollama, LM Studio, LocalAI) and supply its bearer:

export AURA_LLM_BASE_URL="https://llm.internal.example/v1"
export AURA_GATEWAY_TOKEN="<bearer for your endpoint>"

An unlicensed / offline node still detects and reasons heuristically — it runs permissively with all collectors on. A valid license enables the entitlement-gated collectors; the AI investigation additionally needs a reachable gateway and degrades to deterministic detection when the gateway is unavailable or the token budget is exhausted.

5. Confirm the first detection

Antemure includes a safe test-incident capability. It stages benign-but-suspicious activity on the endpoint — a harmless masquerade binary that “beacons” to a reserved IP and adds a cron entry, never real malware — so you can watch a complete cycle. Trigger it from the endpoint console's ⚡ Simulate attack button or the API:

curl -s -X POST http://<endpoint>:18900/api/simulate \
  -H "Authorization: Bearer $AURA_NODE_API_TOKEN"

Detection typically lands within ~30–60 s. Watch it resolve on the endpoint console (:18900) and the fleet dashboard (:18901), or via the API:

curl -s http://<endpoint>:18900/api/incidents
curl -s http://<endpoint>:18900/api/reasoning/latest

Configuration — tune collectors, thresholds, retention and SIEM export.
Investigation & Remediation — raise the risk tier and enable autonomy safely.
SOAR & Playbooks — build approval-gated response automations.
Tokens, Auth & RBAC — lock down the node token and configure hub SSO.