Deploy Kaimz on
your own infrastructure

Getting started / 01

Kaimz is self-hosted. You run three things: the brain (correlation + APIs), the console (web UI), and one or more agents on the endpoints you protect.

1. Provision a Linux host (2+ vCPU, 8 GB RAM) for the brain + console.
2. Deploy the brain and console (Node + Next.js) behind your reverse proxy.
3. Open the console, complete first-run setup and enable MFA.
4. Install the agent on each endpoint.
5. Watch telemetry, detections and the Threat Storyline populate in real time.

Architecture / 02

Hub-and-spoke, all inside your network:

• Brain — ingests agent telemetry, runs detection/correlation engines, serves APIs over mTLS.
• Console — operator UI (dashboards, SIEM, SOAR, identity, Threat Storyline).
• Agents — lightweight endpoint sensors that stream events and execute response actions.

No component calls a vendor cloud. Intel feeds (NVD/CISA/IOC) are pulled on a schedule and cached locally.

Deploy agents / 03

Agents register to the brain, stream process / network / AMSI telemetry, and run scans (vuln, malware, NHI, exposure, ransomware canary, device posture).

• Windows — runs as SYSTEM with a self-healing watchdog and ~30s heartbeat.
• Linux — runs as a systemd unit.
• RTR response — isolate/lift, kill, quarantine, scan, forensics.

# Linux — one-line install (registers to your brain)
curl -fsSL https://<brain-host>/install-agent.sh | sudo bash

# Windows — elevated PowerShell
irm https://<brain-host>/install-agent.ps1 | iex

Engines reference / 04

Every engine ships in every edition — nothing is a paid bolt-on to get basic protection.

API / 05

REST over HTTPS. Authenticate with a console session or an API-key header.

# List managed assets
curl -H "x-kaimz-key: <YOUR_KEY>" https://<brain-host>:4000/v1/assets

# Trigger a device-posture scan
curl -X POST -H "x-kaimz-key: <YOUR_KEY>" \
  https://<brain-host>:4000/v1/device-posture/scan

Common endpoints include /v1/assets, /v1/detections, /v1/incidents, /v1/siem, /v1/nhi, /v1/exposure, /v1/ransomware and /v1/device-posture.

FAQ / 06