One lightweight agent for every endpoint signal
EUTA replaces a stack of single-purpose collectors with one process. It collects telemetry, runs local detections, carries out response actions and forwards events to Orbit AI Ops and the SIEM tools you already use.
Collectors, detections and outputs in one Go binary
Each collector can be switched on or off per policy. Events pass through local detection, then into the encrypted queue, then out to every configured destination.
Collect
- File integrityinotify-based watching of critical paths with SHA-256 hashing of each change
- Kernel and auditBridge to the Linux audit subsystem for system-call level events
- ProcessesProcess starts, parent–child chains and command lines
- Network connectionsHost-level connection tracking per process
- System inventoryOperating system, installed packages and host details
- ContainersDocker container start, stop and change events
- Configuration checksSecurity configuration checks based on CIS benchmarks
- Rootkit checksHidden-process and rootkit scans on a schedule
Detect and protect
- Local detectionsRules evaluated on the endpoint
- Active responseBlock IP, quarantine file, stop process
- Encrypted queueBuffered on disk through outages
Forward
- Orbit AI OpsManagement and operations console
- WazuhCompatible output format
- Syslog, CEF, JSONAny SIEM or log pipeline
File integrity monitoring
EUTA watches the paths you choose and records a SHA-256 hash for every create, change and delete. When a web shell lands in a web root or a binary is replaced, the event reaches your analysts as it happens, with the process that made the change.
Detection and active response
Local detections run on the endpoint, so a finding does not wait for a round trip to the console. When an analyst or a policy decides to act, EUTA can block an IP address, quarantine a file or stop a process. Every response command is authenticated with a token and written to the audit log. Response actions are compatible with Wazuh active response.
Reliable delivery
Events are written to an encrypted queue on local disk before they are sent. Collection continues while a SIEM or the network is busy or unavailable, with the backlog kept on disk across reboots. In our lab test, a burst of 200,000 events was queued and delivered to Orbit AI Ops over TLS with no events lost.
Send to more than one destination
EUTA is designed to forward the same event stream to Orbit AI Ops and to one or more SIEMs at the same time. That lets you run a new platform beside the current one, or keep a copy in a data lake, without installing a second agent.
Configuration without restarts
Collection rules, response policy and outputs are managed centrally and pushed through the REST management API. The agent applies a new configuration while running, without a restart.
Hosts, containers and clusters with the same agent
Exact operating system versions and CPU architectures are listed with each release on the Downloads page.
Linux
Native package. Audit, FIM, process and network collectors.
Windows
Same codebase and policy model as Linux.
Docker
Container events and runs as a container itself.
Kubernetes
Deploy as a DaemonSet with one policy per cluster.
Built to be trusted on production hosts
An agent runs with high privilege on every server you own. We publish resource figures only with the test method behind them.
| Area | Detail |
|---|---|
| Memory footprint | Benchmark report in preparation |
| Throughput | Benchmark in progress; figures will be published with the test method |
| Event queue | AES-256-GCM |
| Agent to Orbit transport | TLS-encrypted syslog |
| Response commands | Token-authenticated and audited |
| Configuration reload | Applied live through the management API |
| Licence | Apache 2.0 |
What is released and what is planned
| Capability | Status |
|---|---|
| Telemetry collectors, FIM, active response, encrypted queue, live configuration reload | Early access |
| Multi-destination forwarding | Early access, in validation |
| Configuration checks based on CIS benchmarks (partial coverage) | Early access, partial |
| CVE and vulnerability matching against installed packages | Planned |
| Behavioural anomaly detection | Planned |
Put EUTA on a test host this week
We will help you enrol a first set of agents and forward to your current SIEM, so you can judge the data for yourself.