shallotd is the central daemon. It ingests alerts from multiple sensors,
normalizes them, deduplicates, enriches with GeoIP/DNS, and runs AI triage.
Everything flows into a SQLite database and this dashboard.
Install Endpoint Agents
Two agent types protect your endpoints. Clove (Wazuh-based) handles log analysis,
file integrity, and rootkit detection. Argus is the heavy sentinel for credential
monitoring, session tracking, evidence capture, and anti-tamper. Both work on Windows;
Linux uses Clove. Pick what fits each machine.
Linux
Windows
clove Wazuh agent
✓
✓
argus Sentinel
—
✓
Linux Endpoints
Installs the Clove agent (Wazuh) with custom detection rules.
Monitors SSH, file integrity, rootkits, reverse shells, suspicious downloads, Docker, and systemd changes.
Idempotent — safe to re-run on an endpoint that already has it.
Windows Endpoints
The Windows installer deploys Argus by default (credential monitoring, Event Logs,
RDP sessions, USB, evidence capture). Add -Wazuh to also install the
Clove Wazuh agent for file integrity and log analysis —
both agents run side-by-side.
File integrity monitoring, Windows Event Log analysis, rootkit detection,
active response, vulnerability detection, security configuration assessment
Argus uses port 8855 on the server — make sure it’s open.
The installer auto-installs Python if needed. Both agents run as background services.
Diagnostics — shallot-doctor
shallot-doctor is the all-in-one diagnostic, backup, and repair tool.
Run it on your central server whenever something seems wrong.
Full health check:
sudo bash setup/shallot-doctor check
All commands:
check
Full diagnostic: services, ports, DB integrity, TLS, backups
backup
Backup config + DB + TLS certs + crontabs
restore <file>
Restore from a backup tarball
fix-tls
Regenerate self-signed TLS certificate
fix-crons
Reinstall maintenance cron jobs
fix-service
Reinstall + restart the systemd service
fix-perms
Fix file permissions and group membership
reset-config
Reset config.yaml to defaults
The check command verifies: service status, port availability, database integrity,
TLS cert validity, backup freshness, and log file accessibility. Start here for any issue.
Component Guide
suricata Network IDS
Inspects all network traffic in real-time using signature-based detection.
Alerts when packets match known threat patterns (malware C2, scanning, exploits).
Watches the wire — everything entering and leaving your network.
wazuh Endpoint Security
Agent-based monitoring on Linux/Windows endpoints (via Clove installer).
Covers file integrity, log analysis, rootkit detection, authentication monitoring.
Alerts when something changes on a host.
argus Endpoint Sentinel
Heavy Windows-focused endpoint agent. Monitors Windows Event Logs, credential file access,
RDP/network sessions, USB devices. Includes evidence capture and anti-tamper.
The “big brother” for high-value endpoints.
crowdsec Crowd Intelligence
Community-powered threat intelligence. Detects brute force, scans, and known bad IPs
using shared blocklists. Can automatically firewall attackers via bouncers.
pfsense Firewall Logs
Ingests pfSense filterlog entries via syslog. Shows blocked/allowed traffic
at the firewall level — useful for seeing what your firewall is stopping.
Severity Levels & Verdicts
critical
Active exploitation or compromise. Investigate immediately.
high
Likely malicious. Needs prompt investigation.
medium
Suspicious activity. Review when possible.
low
Informational noise. Usually benign.
pending
Not yet triaged. AI reviews in batches, or set manually.
investigate
Needs human review. Something looks wrong.
escalate
Confirmed threat or high-priority finding.
suppress
Known noise. Benign scanners, internal traffic, etc.
Troubleshooting
No alerts appearing
Run sudo bash setup/shallot-doctor check
Verify Suricata is running: systemctl status suricata
Check EVE log exists: ls -la /var/log/suricata/eve.json