Talus Field Guide

Deployment & tuning playbook for real Linux servers. Written by the author — every flag here is a real interface of the agent, nothing invented.

1. Pick your deployment mode before anything else

2. Install and sanity-check in five minutes

# Option A: pip installer (pulls the prebuilt release binary, no compiler needed)
pip install talus-process-monitor
talus-monitor install                            # downloads the agent from GitHub Releases
                                                 # (v0.8.1-f: eBPF object is embedded — no .o install step)

# Option B: cargo (builds from crates.io)
cargo install process-monitor

# Option C: build from source
git clone https://github.com/BartoszOsiej/talus-process-monitor.git
cd talus-process-monitor && ./build.sh          # TUI variant, ~1.7MB
# or: ./build.sh --web                          # + REST API, WebSocket, Prometheus (Enterprise)

./install.sh                                   # user-local install (default)
sudo ./install.sh --system                      # /usr/local system-wide

# 5-second end-to-end self-diagnostic (eBPF loads? events flowing?):
sudo process-monitor monitor --diagnose

If --diagnose completes cleanly, the pipeline works end-to-end on your kernel. If it fails: check you are root (or CAP_BPF/CAP_SYS_ADMIN, as in the Docker example), and that BTF is available (ls /sys/kernel/btf/vmlinux).

3. Tuning the one knob that matters: the threshold

Talus alerts when a process opens N or more files within 1 second (default --alert-threshold 50). That single number is your false-positive dial:

• Backups, sync jobs, media encoding — these legitimately touch hundreds of files per second. Run during a real backup window; if Talus flags the backup process, raise the threshold above the observed rate (e.g. --alert-threshold 400).
• Typical web/API hosts — the default 50 rarely fires on legitimate traffic. Keep it.
• Paranoid mode (tiny document sets, archives) — --alert-threshold 20. Expect noise; tune or accept.

# Measure what normal looks like on this host:
sudo process-monitor monitor --benchmark 30      # throughput + hot processes

# Narrow the view to the file types you actually protect:
sudo process-monitor monitor --filter-ext pdf
sudo process-monitor monitor --filter-ext enc

4. Ship it as a service

# /etc/systemd/system/talus.service
[Unit]
Description=Talus eBPF ransomware tripwire
After=network.target

[Service]
ExecStart=/usr/local/bin/process-monitor monitor --json --alert-threshold 400
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload && sudo systemctl enable --now talus
journalctl -u talus -f                            # watch the NDJSON stream

5. MeMLP — the neural layer, when to switch it on

--memlp enables the online-training detection engine. It learns from live events and saves a checkpoint every 30 seconds:

sudo process-monitor monitor --memlp --memlp-checkpoint /var/lib/talus/memlp.json

• Switch it on after the threshold is sane — it learns from the stream you give it.
• The checkpoint persists across restarts: the model you trained stays yours.

6. Enterprise wiring (license → dashboard → exports)

# Activate your license (no root required):
process-monitor license activate KEY
process-monitor license verify

# Web dashboard + REST API + Prometheus (build with ./build.sh --web first):
sudo process-monitor monitor --web 0.0.0.0:8080 --auto-kill

# Stream detections into your data stack:
sudo process-monitor monitor --auto-kill \
  --kafka-brokers localhost:9092 --kafka-topic talus-detections \
  --clickhouse http://localhost:8123 \
  --memgraph http://localhost:7474

7. Runbook: an alert fired — now what

• In Observe/Pipeline mode: identify the process from the JSON event (pid, comm, exe). If it is not a known job — stop it, snapshot the directory tree, check for rename chains and new .enc-style extensions.
• In EDR mode: Talus already killed the process (SIGKILL at threshold breach). Verify with journalctl -u talus | grep kill, then preserve evidence before restoring from backup.
• After any incident: re-run --diagnose, review whether the threshold should move, and keep the 24h JSON window as evidence.

8. Honest limits

• Talus watches file-event behaviour. It is not an antivirus, not a network IDS, and it will not catch a threat that touches zero files.
• eBPF requires BTF/CO-RE support (recent kernels; the Docker runbook mounts /sys/kernel/btf explicitly). Old LTS boxes need a plan.
• One threshold for the whole host: workloads with wildly different IO profiles on one box need either separate hosts or a higher threshold.

Frequently asked questions