Install and first run

Svarog runs on Ubuntu. It is delivered to you directly; we install it with you. This page is what that install looks like.

1. Install

Two package flavours — pick one:

• Lean (svarog_1.0.0_all.deb) — small, uses the system Python 3.

  sudo apt install ./svarog_1.0.0_all.deb

  Needs python3 (≥3.9) and, for live sensors, auditd / falco etc. (the package recommends them). openssl is used for fleet certificates.

• Bundled (svarog-bundled_1.0.0_amd64.deb) — self‑contained: its own Python runtime and dependencies are inside, so it installs and runs with nothing else to set up.

  sudo apt install ./svarog-bundled_1.0.0_amd64.deb

Both install the same two services (not started automatically):

sudo systemctl enable --now svarog            # the daemon (notify-only)
sudo systemctl enable --now svarog-console    # the operator console, 127.0.0.1:8420
journalctl -u svarog -f                        # watch its decisions

Open the console in a browser: svarog open, or launch Svarog from the application menu, or go to http://127.0.0.1:8420.

2. First run — the console login gate

The first screen is a login gate. The first person to register becomes the boss:

1. Register — your name, email, and a password (8+ characters).
2. Set an approval code. Everyone else who joins types this code to be let in; changing it later signs out everyone but you.
3. A short onboarding points you to: install sensors, (optionally) pick a model, (optionally) set up mail.

Later operators register with their own name, email and password, then enter the boss’s approval code to be verified. The boss can be emailed when someone asks to join (Settings → Mail); without mail, pending operators show under Operators.

3. Sensors

The audit log (auditd) is the baseline and is always read. Falco and Suricata add more when installed; YARA file scanning runs on demand. Svarog only ever sees what your sensors see — turn on the ones that match what you want watched.