ATHERNEX / DOCUMENTATION

Start with the
working system.

A practical entry point to the Rust SIEM, its agent gateway, and the research behind a datacenter in one rack.

AVAILABLE TODAY · SINGLE-HOST LINUX SIEM

01 / Run the SIEM

You’ll need Rust 1.89 or newer, a C compiler for bundled SQLite, and Linux with journald for live system and authentication collection. Clone the lab, then start the foreground server:

git clone https://github.com/CharlesDerek/lab.git
cd lab
make run-siem

Open http://127.0.0.1:8787 on that machine. In a second terminal, from the lab directory, display the saved operator key:

make siem-key

Paste the value into the console’s Operator key field. The Makefile uses the same private key file across restarts. If an older manual server used a temporary key, stop it and restart with make run-siem once.

To stop: press Ctrl+C in the terminal running the server. Pending telemetry is flushed on graceful shutdown.

02 / Explore with public fixtures

The separate demo mode provides populated investigations, an agent hive and compressed archive blocks. It does not collect the host journal. Stop the first server before using the same port, or choose another port:

make run-siem-demo SIEM_PORT=8788
# Open http://127.0.0.1:8788
# In another terminal: make siem-key

The screenshots on this site come from controlled fixtures, using this same Rust console. They are not a hosted SIEM session.

03 / Install as a local service

The optional installer creates a private systemd user service, preserves existing credentials and data, and starts the SIEM on loopback.

make install-siem
make siem-key
systemctl --user status athernex-siem

Stop the service with:

systemctl --user stop athernex-siem

To also disable automatic startup, use systemctl --user disable --now athernex-siem. The service follows the user manager’s lifetime; pre-login startup and survival after logout require separately administered lingering. Read the full deployment guide for permissions, data locations and backup instructions.

04 / Go deeper

Platform overview ↗Integration contracts ↗Crustation migration ↗Research findings ↗Rust implementation ↗Changelog ↗

05 / Understand the boundary

The deployable foundation is a single-host SIEM and a capability gateway for its own resources. The current planner is deterministic. Endpoint response, the SIEM-to-orchestrator bridge, enterprise identity federation and whole-rack performance validation remain open work.

Project Crustation’s source repository is published as Crustacian. The migration plan preserves its endpoint evidence and durable delivery guarantees before introducing governed response.