talus-process-monitor hooks syscall tracepoints in the Linux kernel, scores per-process open-rates in one-second windows and terminates the encryptor with SIGKILL — guardrailed, whitelist-aware, and never at the cost of the host. One static binary. No kernel modules. No telemetry.
$50 per node · 12 months of updates · license key delivered on checkout · VAT invoice via Polar
Detection is the easy half. Talus ships the half nobody writes up: the response path.
Mass file-opens scored per process in 1s windows; canary reads, mass-delete and exfiltration-spike detectors. Signature-free — catches strains nobody has named yet.
When the verdict fires, the offending process is killed immediately. Guardrails, per-path whitelists and canary verification keep it fast without being reckless.
The agent sandboxes itself before it starts watching: no kernel modules, no writable footprint outside its own directory, verified by its own tests.
Forward alerts as RFC5424 or CEF, stream raw events to Kafka, persist to ClickHouse, explore process lineage in MemGraph. Self-hosted, your infrastructure.
pip install talus-process-monitortalus-monitor installsudo talus --web 10.0.0.5:8443talus-monitor selftest --canaryThe canary self-test simulates a ransomware burst with harmless file operations and prints the real verdict — detection proof on your hardware in under a minute. Full flags and tuning: /docs.
Enterprise tier — one host, one year of updates.
| Detection engine (eBPF, scoring, sweep detectors) | MIT — free |
| Dashboard, REST API, WebSocket | $50/node |
| Auto-kill response path | $50/node |
| SIEM / Kafka / ClickHouse / MemGraph sinks | $50/node |
| Source | Public, MIT |
Batch prepaid keys at the $50 floor, your margin above, your pricing. Write to [email protected] for the vendor order form — net-30 available on direct invoice.
Every release ships with an SBOM and build attestation; provenance is continuous, not advertised in slide decks.
Full dependency inventory attached to every release asset.
Sigstore-style provenance linking source commit to published binary.
Supply-chain posture measured continuously on the flagship repository.