Aegis

• 

• 

• 

• 

• 

• 

• 

• 

• 

Inspiration

Modern host security tools generate enormous amounts of data, but security teams still spend too much time manually reviewing alerts, writing scripts, verifying vulnerabilities, and coordinating remediation across disconnected systems.

We built Aegis around a simple idea: AI should do more than explain security events—it should help complete the entire security workflow. By combining large language models with eBPF, Sigma rules, vulnerability intelligence, and controlled automation, Aegis turns fragmented security signals into actionable decisions while keeping humans in control of high-risk operations.

Our goal is to create an AI-native host security platform that makes advanced protection accessible to both security specialists and DevOps teams.

What it does

Aegis provides a unified platform for host security auditing, vulnerability management, runtime threat detection, investigation, and automated response.

It can:

• Manage hosts and deployed security agents.
• Convert PDF, Word, Excel, YAML, and text-based security standards into executable baseline checks.
• Use AI to generate inspection, remediation, vulnerability verification, and self-healing scripts.
• Inventory installed software and identify potential CVE exposure.
• Verify vulnerabilities using AI-generated proof-of-concept scripts.
• Monitor process execution, sensitive file access, and network connections in real time using eBPF.
• Match runtime events against Sigma detection rules directly on the host.
• Aggregate alerts and use a ReAct-based AI agent to reconstruct attack paths and recommend actions.
• Dynamically generate and deploy eBPF detection packages for specific vulnerabilities and attack patterns.
• Automatically or manually block threats according to policies and MITRE ATT&CK techniques.
• Audit every generated script before execution through blacklist checks, AI review, pre-dispatch validation, and Agent-side enforcement.

Together, these capabilities create a closed security loop: discover, detect, analyze, verify, remediate, and learn.

How we built it

Aegis uses a distributed architecture designed for real-time security workloads.

The backend is implemented in Go and divided into several services:

• The API Server provides the REST control plane, AI services, task management, and data access.
• The Agent Server maintains bidirectional gRPC streams with deployed host agents.
• The Data Consumer processes Kafka security events, aggregates alerts, and coordinates analysis and response.
• The host Agent collects runtime telemetry, evaluates Sigma rules, and securely executes approved tasks.

The frontend is built with Vue 3, Element Plus, Pinia, Axios, and ECharts.

PostgreSQL stores operational data, Redis supports caching and queues, MinIO stores scripts and Agent artifacts, and Kafka carries runtime security events between services.

For threat detection, we combined eBPF-based telemetry with Agent-side Sigma matching. The Agent automatically selects ring buffer or perf buffer collection according to kernel capabilities.

For intelligent analysis, Aegis integrates OpenAI-compatible language and image models through a worker-queue architecture. A ReAct agent performs planning, controlled tool calls, reflection, correction, and final summarization. Server-Sent Events stream its progress to the interface in real time.

Challenges we ran into

One major challenge was supporting eBPF across different Linux kernel versions. Kernel capabilities, event structures, and buffer mechanisms vary between environments, so we designed adaptive ring-buffer and perf-buffer collection while isolating detection-package failures from the main Agent process.

Another challenge was controlling the risk of AI-generated scripts. A useful remediation script can also contain destructive commands. We built a layered safety pipeline that combines configurable command blacklists, AI security review, regeneration limits, pre-dispatch validation, Agent-side validation, approval workflows, and complete audit trails.

AI alert analysis introduced a different problem: large volumes of repetitive events can overwhelm the model and obscure the actual attack chain. We addressed this through event aggregation, deduplication, context compression, batch analysis, structured evidence, and attack-path visualization.

Maintaining reliable state across the API Server, gRPC services, Kafka, the Agent, and the frontend was also challenging. Tasks can be delayed, rejected, interrupted, or retried at several points, making status synchronization, idempotency, and observability essential.

Accomplishments that we're proud of

We are proud that Aegis goes beyond producing AI-generated security reports. It connects AI reasoning to real security capabilities while maintaining explicit safety boundaries.

Some of our most important accomplishments include:

• Building an end-to-end workflow from baseline document ingestion to executable checks and remediation.
• Creating a unified script security audit system covering baseline, vulnerability, POC, and self-healing scripts.
• Combining real-time eBPF telemetry with Sigma detection and AI-assisted attack investigation.
• Supporting dynamic eBPF detection packages without compromising the stability of the core Agent.
• Visualizing AI planning, tool calls, evidence, corrections, conclusions, and attack traces in real time.
• Creating a distributed platform that can be deployed through Docker Compose or an offline Linux package.
• Designing and developing Aegis as an AI-assisted engineering project while applying the same security and audit principles to the AI itself.

What we learned

We learned that the most valuable role for AI in cybersecurity is not simply generating text. Its real value comes from connecting reasoning with trusted tools, structured evidence, approval controls, and verifiable execution results.

We also learned that automation and safety must be designed together. The more capable an AI security system becomes, the more important risk classification, least-privilege access, human approval, execution isolation, and auditing become.

Finally, runtime security data must be filtered and structured before it reaches the model. High-quality context, clear tool boundaries, and reliable feedback loops often improve results more than simply using a larger model.

What's next for Aegis

The next stage of Aegis is a dual-mode intelligent security command center.

The existing visual interface will remain available for precise manual control, while a new intelligent workspace will allow users to investigate hosts, run baseline checks, scan vulnerabilities, generate detection rules, analyze alerts, and initiate remediation through natural-language conversations.

Planned capabilities include:

• A global security assistant connected to existing Aegis services through a controlled tool registry.
• Human approval, whitelist, and full-access execution modes for different operational environments.
• External MCP data-source integration for combining evidence from SIEM, CMDB, EDR, ticketing, and threat-intelligence systems.
• Specialized host-investigation agents that reconstruct attack entry points, timelines, evidence chains, and affected assets.
• Conversational orchestration of dynamic detection packages, Sigma rules, blocking policies, and remediation tasks.
• Stronger asset discovery, weak-password detection, cross-host correlation, and proactive threat hunting.

Our long-term vision is for Aegis to become a collaborative AI security operator—one that can continuously understand infrastructure, investigate threats, recommend defensible actions, and safely execute approved responses.

Built With

• c
• codex
• golang
• postgresql
• vue