Skip to content
ZeravaDocs

The Svarog guide

For everyone in your company who runs a machine that matters. Version for Svarog 1.0.

Who is responsible for what. Svarog is a tool. How well it protects you depends on how your company and your operators use it: which sensors you turn on, how you answer held calls, whether you turn on automatic containment, and whether your operators stay on their mission. Zerava Technologies provides Svarog’s updates and maintenance under your paid subscription, delivered to you.

What Svarog is

Section titled “What Svarog is”

Svarog is an agentic defender. It guards everything Perun guards — the AI‑agent layer, eight of the nine kinds of attack — and the classic layer around it: ransomware, intrusions, malicious files, network attacks. It does all of it through its own AI agents:

  1. Sensors see. On the host, sensors (the audit log, and optionally Falco, Suricata and YARA) turn what happens — files, processes, the network — into a stream of events.
  2. Reflexes catch the clear cases. Fast, deterministic rules fire at once on obvious patterns: a burst of file writes, a port scan, repeated failed logins.
  3. An agent reasons about the rest. A triage agent reads intent and tells an attack from an accident — an admin’s slip, a drifting‑not‑hostile program, a bad update.
  4. Governance decides. Every proposed action goes through the same floor as everything else, and what cannot be undone, or is unclear, waits for a person.

The four verdicts

Section titled “The four verdicts”
  • Allow — safely benign; let it run.
  • Contain — it endangers, but the source is not a proven enemy: a reversible protective measure, without branding anyone. The default when unsure.
  • Held — an irreversible measure, or an unclear danger: a human decides.
  • Enemy — clearly hostile; contained and the source marked.

Notify‑only by default

Section titled “Notify‑only by default”

Out of the box Svarog proposes and holds — it executes nothing on its own. Automatic containment is turned on deliberately, when you want it. Reversible measures (suspend a process, quarantine a file, block an address) can be undone; nothing is ever deleted to defend you.

Section titled “Read next”
  • Install and first run — the two packages, the services, and the console’s login gate.
  • Operate — the console tabs, the optional model, the safety notes, and the honest limits.

Svarog is delivered to you directly, never a public download. Want only the AI‑agent layer? That is Perun.