Deployment & tuning playbook for real Linux servers. Written by the author — every flag here is a real interface of the agent, nothing invented.
| Mode | Command | Use when |
|---|---|---|
| Observe | sudo process-monitor monitor | First week. Learn what normal looks like on YOUR hosts. Zero risk. |
| Pipeline | sudo process-monitor monitor --json | You already run a log stack (rsyslog, Loki, SIEM). Detection without response. |
| EDR | sudo process-monitor monitor --auto-kill | Hosts that hold things worth keeping, after tuning. Requires Enterprise license. |
Rule of thumb: never start in EDR mode. Tune in Observe, graduate to EDR. A wrong kill on a backup job is worse than a slow alert.
# Option A: pip installer (pulls the prebuilt release binary, no compiler needed)
pip install talus-process-monitor
talus-monitor install # downloads the agent from GitHub Releases
# (v0.8.3: eBPF object is embedded — no .o install step)
# Option B: cargo (builds from crates.io)
cargo install process-monitor
# Option C: build from source
git clone https://github.com/Hartwell-Labs/talus-process-monitor.git
cd talus-process-monitor && ./build.sh # TUI variant, ~1.7MB
# or: ./build.sh --web # + REST API, WebSocket, Prometheus (Enterprise)
./install.sh # user-local install (default)
sudo ./install.sh --system # /usr/local system-wide
# 5-second end-to-end self-diagnostic (eBPF loads? events flowing?):
sudo process-monitor monitor --diagnose
If --diagnose completes cleanly, the pipeline works end-to-end on your kernel. If it fails: check you are root (or CAP_BPF/CAP_SYS_ADMIN, as in the Docker example), and that BTF is available (ls /sys/kernel/btf/vmlinux).
Talus alerts when a process opens N or more files within 1 second (default --alert-threshold 50). That single number is your false-positive dial:
--alert-threshold 400).--alert-threshold 20. Expect noise; tune or accept.# Measure what normal looks like on this host: sudo process-monitor monitor --benchmark 30 # throughput + hot processes # Narrow the view to the file types you actually protect: sudo process-monitor monitor --filter-ext pdf sudo process-monitor monitor --filter-ext enc
FP triage method: run --json for 24h into a file, jq the alerts, and whitelist the two or three noisy legitimate processes by adjusting the threshold — not by disabling the agent. One evening of work, once per host type.
# /etc/systemd/system/talus.service [Unit] Description=Talus eBPF ransomware tripwire After=network.target [Service] ExecStart=/usr/local/bin/process-monitor monitor --json --alert-threshold 400 Restart=always RestartSec=5 [Install] WantedBy=multi-user.target
sudo systemctl daemon-reload && sudo systemctl enable --now talus journalctl -u talus -f # watch the NDJSON stream
--memlp enables the online-training detection engine. It learns from live events and saves a checkpoint every 30 seconds:
sudo process-monitor monitor --memlp --memlp-checkpoint /var/lib/talus/memlp.json# Activate your license (no root required): process-monitor license activate KEY process-monitor license verify # Web dashboard + REST API + Prometheus (build with ./build.sh --web first): sudo process-monitor monitor --web 0.0.0.0:8080 --auto-kill # Stream detections into your data stack: sudo process-monitor monitor --auto-kill \ --kafka-brokers localhost:9092 --kafka-topic talus-detections \ --clickhouse http://localhost:8123 \ --memgraph http://localhost:7474
Kafka/ClickHouse/Memgraph flags are independent — wire only what your stack already has. Nothing leaves the host by default.
.enc-style extensions.journalctl -u talus | grep kill, then preserve evidence before restoring from backup.--diagnose, review whether the threshold should move, and keep the 24h JSON window as evidence./sys/kernel/btf explicitly). Old LTS boxes need a plan.Start in Observe mode (sudo process-monitor monitor) for about a week. It is detection-only with zero risk of a wrong kill, and it teaches you what normal file activity looks like on your hosts. Graduate to Pipeline mode (--json) when you run a log stack, and to EDR mode (--auto-kill) only after tuning, on hosts that hold things worth keeping.
pip install talus-process-monitor, then run talus-monitor install — the Python installer pulls the prebuilt release binary (~4 MB) from GitHub Releases, no Rust toolchain needed. Alternatively cargo install process-monitor builds from crates.io, or ./build.sh compiles from source.
Talus alerts when a process opens N or more files within 1 second (default --alert-threshold 50). Keep 50 on typical web/API hosts, raise it above the observed rate of legitimate write-heavy jobs like backups (e.g. --alert-threshold 400), or lower it to 20 in paranoid mode for tiny document sets. Run monitor --benchmark 30 to measure what normal looks like on your host first.
Talus needs eBPF with BTF/CO-RE support, which means recent kernels. Check with ls /sys/kernel/btf/vmlinux — if that file exists, the agent loads. The Docker runbook mounts /sys/kernel/btf explicitly. Old LTS kernels without BTF need a separate plan; there is no kernel module fallback by design.
Do not panic-kill. First identify the process from the alert output, then check whether it is a legitimate write-heavy job (backup, sync, media encoding) that simply crossed the threshold — if so, raise the threshold instead of disabling the agent. If the process is unknown, snapshot-preserve the target directories before any response, then pause or kill. The runbook section above walks through this decision step by step.
Capabilities, the sixty-second start and the component licensing table are on the product page. The agent itself is free and MIT forever — the Enterprise license adds auto-kill, the web dashboard and the Kafka/ClickHouse exports.