# aertun > Aertun checks what AI defenders produce — detection rules, triage verdicts — against evidence they did not write, and signs the result. Self-hosted, one binary. aertun is one Go binary with no third-party dependencies, licensed under Apache-2.0. Source: https://github.com/aertun/aertun ## Get started - [Get started](https://aertun.github.io/start/): Build aertun, create a store and its first administrator, sign in with a passkey, then connect a source, install detections and decide who else may do what. - [Install and run aertun](https://aertun.github.io/install/): Build aertun from source with Go alone, install it with make, run it under systemd or in a distroless container, and put it behind a reverse proxy. - [Glossary](https://aertun.github.io/concepts/): Short definitions of the words the aertun manual and console use: sources, events, detections, findings, cases, regimes, playbooks, actions, the audit log. ## Proving AI work - [Proofs: AI work checked and signed](https://aertun.github.io/proofs/): Check a detection rule, usually one a model drafted, against a labelled corpus its author did not write, and sign the verdict as an in-toto DSSE proof. - [The wind tunnel: attacks on AI agents, replayed](https://aertun.github.io/windtunnel/): Replay scripted malicious AI-agent sessions through a recorded stream, measure whether the detections caught them, and sign a scorecard anybody can verify. ## Operations - [Approvals](https://aertun.github.io/approvals/): One screen for everything waiting for you: actions on other platforms, runs an automation held, and privileged changes that need a second administrator. - [Findings and the AI analyst](https://aertun.github.io/findings/): One queue of security findings ranked by risk, decisions kept and replayable, and an AI analyst that suggests a verdict from counts without ever recording one. - [Cases, incidents and notification clocks](https://aertun.github.io/cases/): Declare incidents with the clocks GDPR, NIS2, DORA, SEC, CIRCIA and HIPAA start, run playbooks, and act on other platforms once a second person approves. ## Investigation - [Events and hunting](https://aertun.github.io/events/): Every event mapped to one shape and kept append-only, with retention and legal holds, identity links across platforms, and a hunt that shows what is rare. - [Threat intelligence and indicators](https://aertun.github.io/intelligence/): Import indicators of compromise from STIX 2.1 bundles or plain lists, add them one at a time, and see which events and findings they match. ## Detection - [Detection rules, Sigma and correlations](https://aertun.github.io/detections/): Write detection rules with fixtures, import Sigma, trial a rule before it reaches the queue, correlate across platforms, and suppress noise with an end date. - [Automations](https://aertun.github.io/automations/): Automation rules of the form when this happens, do this, in watch, ask or act mode, with limits, approvals by a second person, and sign-in rules for step-up. - [Connectors, log sources and feeds](https://aertun.github.io/connectors/): Read Okta, Entra ID, GitHub, KnowBe4, Vanta and more through their APIs, map logs from 17 platforms to one shape, and receive SSF, CAEP and webhook feeds. ## Exposure - [Vulnerability management](https://aertun.github.io/vulnerabilities/): Rank vulnerabilities with CISA KEV and EPSS, decide them with SSVC, publish OpenVEX, scan SBOMs against OSV, import SARIF, and plan upgrades clearing most risk. - [Estate, workforce risk and reminders](https://aertun.github.io/workforce/): Join who works here with their devices, training and accounts across your tools, see where coverage is missing, send reminders, and review vendors and access. ## Administration - [People and access](https://aertun.github.io/people/): Grant roles and jobs on a path, deny what a broader grant would allow, explain any decision, provision people with SCIM, and issue tokens that end. - [Roles and separation of duties](https://aertun.github.io/roles/): One Owner, then collaborators with a role (viewer, analyst, responder, admin) or a job, and duties kept apart so nobody, and no agent, acts alone. - [Single sign-on](https://aertun.github.io/sso/): Sign in through OpenID Connect or SAML. Single sign-on counts as two factors only when the identity provider says it used them, or a passkey is asked for. - [Passkeys, enrolment and recovery](https://aertun.github.io/passkeys/): Sign in with a passkey that checks it is you, add one through a one-time enrolment link, lock out failed sign-ins by place, and recover without a password. - [Settings](https://aertun.github.io/settings/): Every aertun setting with what it does and its default. A weaker value needs a recorded reason and a second administrator, and bounds no reason steps past. - [The audit log](https://aertun.github.io/audit/): An append-only audit log: a hash chain, a Merkle tree, heads signed with Ed25519 and ML-DSA, anchored to Bitcoin, written by its own process, streamed out. - [How aertun defends itself](https://aertun.github.io/security/): What aertun may connect to and why, credentials sealed in a vault, a separate log writer, two factors for all, session limits and an AI that only suggests. ## Reference - [The command line](https://aertun.github.io/cli/): Every aertun command, grouped as the console's screens are, and the flags every command takes: --json for machines, --root and --token for identity. - [AI agents over MCP](https://aertun.github.io/mcp/): Connect an AI agent to aertun over the Model Context Protocol: eight operations behind three tools, to read findings and propose decisions, never to act. - [Licence: Apache-2.0](https://aertun.github.io/licence/): aertun is open source under the Apache License 2.0. Use it, change it, embed it in your own product and sell it, with no licence key and nothing held back.