Answers, commands and fixes
A quick reference distilled from the product documentation (v1.1).
Frequently asked questions
Does it attack or send packets?
No. It is defense-only. Demo pcap files are written to disk and never transmitted, and the synthetic attack generator (defend simulate) only creates files.
Does the malware scanner run my files?
No. It only reads bytes. Behavior analysis uses JSON reports from an external sandbox such as Cuckoo/CAPE, where the sample is run in a separate isolated VM — not by this tool.
Does VirusTotal receive my files?
No file is uploaded. Only the SHA-256 hash is looked up. Even so, sending hashes out can conflict with a corporate policy — use --no-vt to disable. Without the VT_API_KEY environment variable the lookup is skipped automatically. “not_found” does not mean safe.
What does “dry-run” mean and how do I really block?
By default the engine only records what it would do. Enforcement requires both --enforce on the command line and defense.enforcement.allow: true in the config; with only one of them it stays in dry-run and tells you why.
Could it block me or my administrators?
Private ranges, the gateway, DNS and currently connected SSH clients are protected by default. If you connect from a public IP, add it to allowlist.cidrs. In an emergency run defend rollback from the console. Always observe in dry-run first.
Which operating systems are supported?
Linux x86_64 is the verified platform (real nft / iptables blocking verified). Windows and macOS can analyze pcaps and scan files; Windows netsh blocking was only simulated, and macOS has no firewall backend (dry-run only).
Can it work without Internet access?
Yes. If the NSL-KDD download fails it falls back to synthetic data (or you copy the files to data/nsl_kdd/), VirusTotal is skipped without a key, the dashboard uses no CDN, and the tests run offline.
Which datasets can I use?
Synthetic, NSL-KDD, your own normal pcap baseline, UNSW-NB15 and CIC-IDS2017 (offline benchmark only), EMBER and SOREL-20M (static malware features), your own PE folders and sandbox reports.
How accurate is it?
On synthetic data the numbers are very high because patterns are simple. On the official NSL-KDD test set precision was 96–98 % but recall 60–66 %. These are laboratory figures; train a baseline on your own traffic and measure before relying on it. See Technology.
Does it detect attacks inside HTTPS/TLS?
No. It works on flow statistics and headers, not payloads; web attacks such as SQL injection or XSS inside TLS need WAF / EDR in parallel.
Which reports and logs does it produce?
Alerts in JSON Lines (SIEM-ready), a hash-chained audit log, and daily / weekly / custom reports as HTML, JSON, CSV and optionally DOCX — all under one logs_dir with rotation and retention.
Is AegisMind an established vendor?
No — AegisMind is newly founded. This website therefore shows no customer names, certifications or statistics. Everything technical comes from the product documentation and is labeled as laboratory results.
Common commands
aisec <command> is the same as python main.py <command>. Exit codes: 0 normal, 1 error, 2 alert / suspicious or malicious found.
| Command | Description |
|---|---|
demo [--quick] [--no-nslkdd] | End-to-end demo of the whole pipeline (about 1 minute offline with --quick --no-nslkdd) |
nids gen-pcap [--benign-only] | Generate a demo pcap (+ ground-truth CSV) — written to file only |
nids train --dataset … --models … | Train NIDS models (synthetic, nslkdd, pcap, unsw, cicids) |
nids detect --pcap F | --iface IF | Detect from a pcap file or a live interface |
hids gen-logs | train | detect | Generate sample logs / train / detect |
malware train-static | train-dynamic | Train the static (XGBoost) or behavior (RandomForest) model |
malware scan TARGET [--behavior R] [--no-vt] | Scan a file or directory and write a JSON report |
malware vt-lookup HASH… | VirusTotal hash lookup |
defend run | Run the defense engine: --iface --pcap --authlog --watch --conn, --enforce, --duration N, --rollback-on-exit, --no-ml |
defend list-blocks | unblock | rollback | gc | prune-logs | Inspect and revert actions; clean expired entries and old logs |
defend list-quarantine | restore <id> --yes | List quarantined files / restore (understand it may be malicious) |
defend verify-audit | self-test | simulate --out DIR | Verify the audit chain / 16-point self-check / generate synthetic attack files |
ui (= monitor) · report [daily|weekly|custom] | Dashboard and reports |
Key configuration items (config/config.yaml)
| Key | Default | Description |
|---|---|---|
logs_dir | logs | Root of all runtime data (relative to the install folder) |
defense.enforcement.allow | false | Must be true and --enforce given for real actions |
defense.enforcement.backend | auto | auto / nft / iptables / netsh / fake / none |
defense.enforcement.max_blocks | 200 | Concurrent block cap |
defense.allowlist.cidrs | [] | Your admin IPs / ranges — always add |
defense.logs.* | 10 MiB · 5 backups · 30 d · reports 365 d | Rotation and retention |
defense.ui.host / port / token / allow_actions | 127.0.0.1 / 8765 / empty / false | Empty token only on loopback; other addresses require a token |
nids.feature_set | common | common (33) or extended (53) |
malware.virustotal.* | enabled, 15 s interval | Key only from the VT_API_KEY environment variable — never write it into files |
Typical problems
| Symptom | Cause / fix |
|---|---|
| Defend shows only “DRY-RUN” | Intended. Enforcement needs --enforce and enforcement.allow: true. |
Permission error on --iface | Raw sockets need root or CAP_NET_RAW. Use sudo, or non-root inputs (--conn, --authlog, --watch). |
| “No backend” — nothing is blocked | nft/iptables missing or no privileges. Check which nft iptables and root; set enforcement.backend. |
| Many false alarms | Retrain the baseline on your normal pcap / logs, raise percentile or min_votes, tune detectors.packet.*, add to the allowlist, observe in dry-run. |
| Released but blocked again at once | The engine still sees the attack. If legitimate, add it to allowlist.cidrs. |
verify-audit FAIL | audit.jsonl was edited, truncated or partly deleted: compare with backups and check log-directory permissions. |
| UI shows 401 / “disallowed Host” 400 | Open /?token=… first or send a Bearer header. For reverse proxies use an SSH tunnel to 127.0.0.1. |
dropped counter rising | Input is faster than processing: narrow with --bpf or disable ML with --no-ml. |
Terms
| Term | Meaning |
|---|---|
| NIDS / HIDS | Network / host intrusion detection system |
| Flow | Bidirectional aggregate of packets of one connection (5-tuple) |
| Dry-run | Record decisions without changing the system |
| TTL | Time-to-live of a block before automatic release |
| Allowlist | Targets that are never blocked |
| YARA | Rule language for matching patterns in files |
| SHAP | Per-feature contribution values explaining a model output |
| Quarantine | Moving a file to a restricted folder (not deleting) |
| Hash chain | Each record stores the hash of the previous one so edits are detectable |
| MSP | Managed service provider |
Talk to us about your environment
Tell us about your network, hosts and constraints. We will propose a dry-run-first pilot plan — no obligation.