Genos documentation | Genos docs

Genos learns what is normal on each of your Linux servers, then blocks changes that break that normal and tells you about them. It doesn't look for known attacks. It looks for deviations from the server's own known-good state.

Genos in one minute

Genos has three parts:

Part	Runs on	Job
Scanner	Each server, once, at install	Records the server's attack surface: its baseline
Enforcer	Each server, all the time	Blocks unauthorized changes in the kernel and reports every decision
Fleet server	genossec.com	Collects reports and shows them on the dashboard. It never sends commands to a server

flowchart LR
  subgraph host["Each Linux server"]
    scanner["Scanner<br/>(once, at install)"]
    enforcer["Enforcer daemon<br/>(always on)"]
  end
  subgraph fleet["genossec.com"]
    api["Fleet server"]
    dash["Dashboard"]
  end
  scanner -- "baseline" --> api
  enforcer -- "signed heartbeats<br/>and decisions" --> api
  api --> dash
  you(["You"]) --> dash

Arrows only point toward the fleet server. A server reports in, and nothing flows back. If a server goes quiet (because the daemon was stopped, the host is down, or traffic is blocked), the dashboard turns that server red. A silent server is treated as an incident.

Where to go next

You want to	Read
Understand the moving parts	How Genos works
Put a server on the dashboard	Quickstart
Find your way around the dashboard	Using the dashboard
Know what an alert means and what to do	Alerts
Configure a server's scanner and daemon	Node setup
Run or troubleshoot the fleet server	Operating the fleet server
See exactly what goes over the wire	API reference
Know what Genos can and can't guarantee	Security model

Status

Genos is early. Before you rely on it, know these limits:

The enforcer is a research prototype. It protects one directory, /etc/sudoers.d, against new files, renames into it and hard links into it. Run it only on disposable VMs.
The scanner speaks plain HTTP. It can't upload to genossec.com yet, so baselines go to a test server for now. See Quickstart.
Root can stop the enforcer. Genos makes that visible on the dashboard; it doesn't make it impossible. See Security model.

Words used in these docs

Term	Meaning
Node or host	One Linux server running Genos
Baseline	The scanner's record of a host's attack surface, taken once at install
Catalog	The list of Linux threat vectors the scanner checks for. The same on every host
Daemon	`genos-daemon`, the enforcer's userspace process. It loads the kernel hooks and reports
Decision	One ALLOW or DENY the enforcer made for a change in a protected directory
Heartbeat	A signed status report the daemon sends every 30 seconds
Enrollment	A daemon's first contact, when it trades a one-time token for an identity

Where the code lives

Folder	Holds
`fleet/`	The fleet server and dashboard
`genos_scanner_enforcer/`	The installable scanner script and the enforcer daemon
`genos_inventory/`	Catalog, scanner and analysis development, with in-depth design docs
Repo root (`app.py`, `templates/`)	The genossec.com website and blog