maiconburn/innerwarden-agent repository overview

⁠Inner Warden — Autonomous Linux Security Agent

Inner Warden is a self-contained, autonomous security agent for Linux servers. It watches every layer of the stack — from firmware and hypervisor all the way up to userspace — correlates events across layers in real time, makes AI-assisted triage decisions, and responds autonomously with reversible enforcement actions.

⁠Quick start

curl -fsSL https://innerwarden.com/install | sudo bash
# starts in observe-only / dry-run mode by default

Images: maiconburn/innerwarden-agent (full agent) · maiconburn/innerwarden-agent:agent-openclaw
Architectures: linux/amd64 · linux/arm64

⁠What it does

⁠1. Detection — 4 rings, 40 eBPF hooks, 49 detectors

49 stateful detectors including: ssh_bruteforce, credential_stuffing, distributed_ssh, port_scan, reverse_shell, process_injection, privesc, rootkit, ransomware, c2_callback, dns_tunneling, container_escape, lateral_movement, crypto_miner, data_exfiltration, fileless, web_shell, log_tampering, kernel_module_load, persistence (ssh_key / crontab / systemd), and 10 graph-based detectors.

Rule engines: 208 Sigma community rules · 8 built-in + custom YARA rules · 71 ATR rules (AI agent threats: prompt injection, tool poisoning, skill compromise).

⁠2. Correlation — 47 cross-layer rules

Cross-layer rules (CL-001–CL-047) connect firmware × hypervisor × kernel × userspace × network × honeypot, including 5 AlphaZero V4 discoveries and Blue Pill / VM-escape / deep-ring-compromise chains. Entity pivot by IP / User / Container / PID with cooldown deduplication.

Kill chain tracker — 7 stages per entity, 8 attack patterns in bitmasks (reverse shell, bind shell, code inject, code execution, lateral movement, privesc, persistence, data exfil).

Baseline anomaly — 7-day EMA training on event rate/hour per source, process lineages, login hours, outbound destinations. Detects silence (= compromise), rate spikes, unseen lineages, unusual login times.

Autoencoder neural — 58 features, nightly retrain at 03:00 UTC, integrated in the agent loop for anomaly scoring.

⁠3. Knowledge Graph — single source of truth

In-memory directed graph: 11 node types (Process, IP, File, User, Domain, Container, Service, Session, Port, Rule, Incident), 50 relation types, 60 event kinds. 27 graph detectors + 10 graph correlation rules + 4 real-time triggers. Daily snapshots with 7-day retention, 3-backup rotation, and integrity checks.

⁠4. Decision — AI triage + graduated enforcement

12 AI providers: OpenAI, Anthropic, Ollama (qwen2.5:3b local default), Groq, Cerebras, DeepSeek, Together, OpenRouter, Fireworks, Mistral, Cohere, +1.

Pipeline: algorithm gate → allowlist → dedup → decision cooldown (1 h per action:detector:entity) → AbuseIPDB (SQLite cache) → GeoIP → incident grouping → AI → MITRE mapping → circuit breaker → confidence threshold → graduated enforcement → skill execution → Cloudflare push → mesh broadcast → notification gate → channels → observation verification → trust scoring.

Graduated enforcement (spec 020): Observe → Warn → Contain → Enforce state machine driven by continuous trust score + AI SOC daily checks (11 parsers).

Structured subgraph prompt (spec 025): LLM receives graph as JSON nodes/edges instead of prose. Benchmark on qwen2.5:3b: accuracy 53% → 73%, hallucination 47% → 7%.

⁠5. Response — autonomous & reversible

11 skills: block-ip (ufw / iptables / nftables / pf / xdp), suspend-user-sudo, monitor-ip, kill-process, block-container, deploy-honeypot, rate-limit-nginx, block-ip-cloudflare, report-to-abuseipdb, kill-chain-response.

Layered blocking: 1 decision → XDP kernel drop + firewall (persists reboot) + mesh broadcast (peers block) + Cloudflare edge + AbuseIPDB report.

20 playbooks: ransomware, reverse_shell, data_exfil, malware_yara, chain-recon-exfil, chain-firmware-rootkit, timestomp, log_tampering, privesc, kernel_module, process_injection, ssh_key/crontab/systemd persistence, container_escape, crypto_miner, dns_tunneling, lateral_movement, web_shell, discovery_burst. Custom TOML playbooks supported.

Live honeypot: SSH/HTTP decoys on port 2222, interactive LLM shell, captures credentials and attacker behaviour, feeds the knowledge graph.

⁠6. Notifications — intelligent gate (spec 005)

Single policy decides Send Now / Daily Briefing Only / Drop per incident. Burst summary: 50+ auto-blocks/h → 1 message "all handled". Grouping: 100 events from the same IP in 1 h = 1 Telegram message.

Channels: Telegram (interactive bot, 2FA, callback buttons) · Slack · Webhook · Web Push · Syslog CEF (ArcSight).

Daily briefing digest at 08:00 with low-severity incidents and summarised decisions.

⁠7. Threat Intelligence

• Attacker profiles — unified per-IP profiles: incidents, decisions, honeypot sessions, IP reputation, GeoIP, AbuseIPDB, CrowdSec, mesh intel, IOCs, MITRE. Behavioural DNA (SHA-256 of hour distribution + detectors + targets + tools). Recurrence tracking. Composite risk 0–100. 10 K profile cap.
• Cross-IP tracking — fuzzy DNA matching detects the same attacker across VPN/Tor rotations. Risk and knowledge are inherited.
• Campaigns — union-find on IOC graph (C2, URLs, domains) + DNA clustering + detector overlap = coordinated attacker groups.
• Monthly threat report — generated on the 1st: executive summary, top-20 attackers, campaigns, MITRE heatmap, geo distribution, honeypot intel (top creds/commands), weekly trends, mesh summary. Markdown + JSON.
• Threat feeds — VirusTotal hash check, generic IOC polling.

⁠8. Mesh — P2P Defence Network

Ed25519-signed peer network. Tit-for-tat trust scoring (game theory). Broadcasts blocks to peers; blocks are applied locally when trust > threshold. 49 tests. Integrated in the agent.

⁠9. Observation & Compliance

• Observation verification (spec 021) — behavioural score engine + AI batch verification cleans active false positives instead of letting them rot in the dashboard.
• ISO 27001 — 12 controls mapped, compliance tab in dashboard.
• Hash chain audit — decisions table with prev_hash + row_hash; /api/compliance endpoint verifies integrity.
• Data retention — configurable policy: events 2 d, graph snapshots 7 d, backups rotated.

⁠10. Dashboard & API

SPA (~11 500 lines). Tabs: Sensors (15-collector HUD + timeline), Threats (investigation journeys with pivot tabs), Report, Health (metrics drift, spec 024), Honeypot, Compliance (ISO + hash chain), Intelligence (profiles / campaigns / chains / baseline / playbooks), Monthly.

20 integration cards: AI, IP Blocker, Honeypot, GeoIP, AbuseIPDB, XDP, Telegram, Slack, Cloudflare, CrowdSec, Prometheus, PagerDuty, Opsgenie, Sudo Protection, Execution Guard, Mesh, Web Push, Fail2ban, Shield, Threat DNA.

Key API endpoints: /api/agent/* (autonomous AI agent: security-context, check-ip, check-command with ATR engine), /api/attacker-profiles, /api/threat-report, /api/campaigns, /api/correlation-chains, /api/baseline-status, /api/playbook-log, /api/auth/*, /metrics (10 Prometheus drift metrics).

⁠11. Storage (spec 016)

Unified SQLite (innerwarden.db, WAL mode) replaces 15 legacy storage artefacts. 14 maintenance tasks. Monotonic agent cursor.

⁠12. Safety Nets & CI (spec 024)

• make scenario-qa — 7 canonical scenarios (SSH brute, honeypot, port scan, DDoS SYN flood, grouped campaign) with tight envelopes; any PR that drifts fails CI.
• 18 contract tests covering notification_gate, response_lifecycle, kill chain, decision cooldown, and correlation response.
• 10 drift metrics tracked via Prometheus.
• make replay-qa — multi-source replay (auth_log + Falco + Suricata + osquery).
• 3 689 tests · ~45% overall coverage.

⁠13. CLI

8 subcommand groups: get (status) · stream · action (block/unblock) · trust · config (notifications/dashboard/AI) · system (scan/harden/doctor/test) · module (install/validate/publish) · agent (chat).

Host hardening: innerwarden system scan (audit) · innerwarden system harden (sysctl, SSH, firewall, sudoers drop-ins).

Self-upgrade: innerwarden upgrade — pulls latest release, verifies SHA-256 + Ed25519 signature, restarts systemd service.

⁠14. Deployment

Binaries: x86_64 + aarch64, Linux + macOS, Ed25519-signed.
Services: innerwarden-sensor, innerwarden-agent, innerwarden-shield, innerwarden-dna, innerwarden-killchain, innerwarden-hypervisor.timer, innerwarden-smm.timer.

⁠At a glance

⁠License

Apache-2.0 — © Inner Warden contributors