Operate

The console

• Live — status, counters, and the live decision stream (sensor → reflex → triage → govern).
• Holds — calls waiting for a human. Approve actually carries out a reversible containment; irreversible actions always wait for you. Reversible blocks (for example an IP block) carry a time limit and lift themselves when it lapses.
• Attackers — what the defender has learned: source reputation (a source seen attacking repeatedly is met harder, sooner), a read of the attack strategy, and proposed defences. Each strategy has Approve / Reject / Explain — Explain opens a real conversation with the model to refine it; nothing runs until you approve.
• Operators — the roster and the boss’s approval code.
• Fleet — several machines under one boss (the fleet networking is a 1.1 beta; use the 1.0 standalone for production).
• Settings — the AI model, mail, and sensors.

Analyst (bottom of the console) answers questions from the shared record with facts, not a model’s words — “what is waiting for me?”, “who attacked me this week?”, “history of 45.9.12.3”. The ⤢ button enlarges the chat.

The model (optional)

Svarog runs fully without a model, on deterministic containment. A local model (GGUF) adds intent‑reading and powers strategy Explain:

svarog triage suggest          # models this host can run
svarog triage use <key>        # download + select one
svarog triage set gguf:/path/to/model.gguf   # or point at one you have

Online backends (Anthropic / OpenAI‑compatible) are possible but discouraged for a guard — they send what is being judged to a third party.

Safety notes

• The console binds localhost only, behind a login, with CSRF protection and login rate‑limiting.
• Automatic containment is off by default; the daemon proposes and holds. Turn it on deliberately: systemctl edit svarog → Environment=SVAROG_AUTO_CONTAIN=1.
• A stored API key and mail password live in the config file, written 0600.

What Svarog does not do yet

We would rather tell you the edges than oversell:

• Linux only, for now. The sensors are Linux; Windows and macOS come later. (Perun, the agent layer, runs on Windows too.)
• It sees what your sensors see. The audit log is always on; a network sensor and a system‑events sensor add more when installed; file scanning runs on demand.
• Reflexes are thresholds. A very slow, very quiet attack — below the line — leans on the AI agent to catch, and the agent is not perfect.
• Malicious files: it catches what your signature rules describe, not every possible file.
• Images, audio and video (the agent layer’s ninth attack): in development, same as Perun.
• The fleet is in beta and not yet security‑reviewed. Use the standalone 1.0 for production.
• Nothing has been measured on your traffic yet — this is in words, not percentages.