Monitor your servers

Scanning finds vulnerabilities from the outside. Iris watches your servers from the inside: it's a lightweight agent that runs on your Linux hosts and reports real-time security events (SSH brute-force, suspicious processes, changes to /etc, tampering with the agent itself) back to Horus, which triages them into findings.

This guide gets an agent running on one server. For the full detail of what Iris watches and how, see the Iris reference.

---

Before you start

• A Linux host (x86_64 or aarch64) with systemd.
• Root access on that host to install.
• Your Horus account (analyst or admin can register agents).

Iris is safe to run on production: it delegates all watching to the kernel's audit and journal subsystems, so it adds no polling overhead and can't introduce latency into the host.

---

Step 1: Register the agent in Horus

1. Open Settings → Iris Agents → Register agent.
2. Give it a name (e.g. the hostname, prod-web-01).
3. Optionally link it to an existing asset.
4. Horus shows you an API key and a one-line install command. The key is shown once only, copy it now.

---

Step 2: Install it on the server

Run the command Horus gave you, as root:

curl -sSL https://<your-horus-host>/api/iris/install.sh | sudo bash

The installer downloads the agent, installs the systemd service, sets up the kernel audit rules, and creates a config file. Then put your credentials in /etc/horus/iris.yaml:

server_url: https://<your-horus-host>
api_key: irs_<key-from-the-dashboard>
agent_id: <uuid-from-the-dashboard>

Start it:

sudo systemctl enable --now horus-iris

Confirm it can reach Horus:

sudo horus-iris --test-connection

The agent should now show as online in Settings → Iris Agents.

---

What you get

Once an agent is online, Horus:

• Alerts immediately on high-confidence threats: SSH brute-force, connections to known command-and-control ports, and any attempt to stop or remove the agent itself. These create findings and in-app notifications the moment they happen.
• Triages the rest with AI on a schedule, grouping routine host events and surfacing only the groups that represent real risk, so normal activity doesn't flood your findings.
• Tells you when a host goes dark. If an agent stops reporting, Horus flags it offline and raises a finding, once per transition.

Events that look serious can trigger a full scan of the affected asset automatically, connecting host activity to your vulnerability picture.

---

Rolling it out

Repeat Step 1 and Step 2 per host. Each host gets its own registration and key. To remove an agent, run the uninstall command from the dashboard on the host and soft-delete the agent in Horus (its history is preserved).