Metadata-Version: 2.4
Name: talus-process-monitor
Version: 0.8.1.post2
Summary: Talus — eBPF ransomware detection & response for Linux (installer for the prebuilt agent binary)
Author: Bartosz Osiej
License: MIT
Project-URL: Homepage, https://bartoszosiej.github.io/talus-process-monitor/
Project-URL: Repository, https://github.com/BartoszOsiej/talus-process-monitor
Project-URL: Changelog, https://bartoszosiej.github.io/talus-process-monitor/changelog.html
Project-URL: Documentation, https://bartoszosiej.github.io/talus-process-monitor/field-guide.html
Project-URL: Comparison, https://bartoszosiej.github.io/talus-process-monitor/comparison.html
Project-URL: Sponsor / Support, https://github.com/BartoszOsiej/talus-process-monitor#support--services
Keywords: ebpf,ransomware,security,linux,edr,detection,incident-response
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: System Administrators
Classifier: License :: OSI Approved :: MIT License
Classifier: Operating System :: POSIX :: Linux
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security
Requires-Python: >=3.8
Description-Content-Type: text/markdown

# talus-monitor — PyPI installer for Talus

**Talus** is a kernel-level ransomware detection & response agent for Linux:
eBPF tracepoints hook syscalls, a per-PID sliding window scores file-open
behaviour, and the response layer can terminate the offending process the
moment a verdict fires. Measured: ~280,000 events/s at ~7.6% CPU.

This PyPI package is an **installer/runner** for the official prebuilt binary
(published on GitHub releases). It is pure Python, stdlib-only, and does not
bundle the agent itself.

```bash
pip install talus-process-monitor

talus-monitor install          # fetches the latest release binary (~1.7 MB)
sudo talus-monitor run monitor --diagnose     # 5-second end-to-end self-check
sudo talus-monitor run monitor                # observe mode
sudo talus-monitor run monitor --auto-kill    # EDR mode (Enterprise license)
```

Prefer building from source?

```bash
git clone https://github.com/BartoszOsiej/talus-process-monitor.git
cd talus-process-monitor && ./build.sh
sudo ./target/release/process-monitor monitor
```

- Free agent, MIT: https://github.com/BartoszOsiej/talus-process-monitor
- Deployment & tuning playbook: https://bartoszosiej.github.io/talus-process-monitor/field-guide.html
- Comparison vs Falco/Wazuh/Tracee: https://bartoszosiej.github.io/talus-process-monitor/comparison.html

Requires Linux with BTF (CO-RE) support and root or CAP_BPF/CAP_SYS_ADMIN to
load the eBPF program. The binary runs on x86_64 Linux.
