AEGIS
What it is
AEGIS is a free, open-source cybersecurity defense platform that organizations host themselves to detect, analyze, and respond to threats. Its listed detections include SQL injection, XSS, path traversal, command injection, brute force, port scans, credential theft, lateral movement, and C2 beacons. The project describes a five-layer detection pipeline and reports an 11/11 detection score, along with 18-microsecond latency for its middleware layer. Deception features include SSH and HTTP honeypots, breadcrumb credential traps, and attacker interaction profiling. AI features can use OpenRouter, OpenAI, Anthropic, or Ollama; deterministic Sigma rules and playbooks are described as operating without an AI API key. The free plan is deployed with Docker Compose and is listed for up to 20 nodes, 100 assets, and three users. It is described for individuals, homelabs, and small teams, and is released under the AGPL-3.0 license. Enterprise adds unlimited nodes, assets, and users, a compliance dashboard for ISO 27001, NIS2, and SOC 2, SAML or OIDC single sign-on, an SLA, and dedicated support; pricing is custom.
For and against
For
- Open-source under the AGPL-3.0 license.
- Detects a range of listed threat types.
- Includes SSH and HTTP honeypots.
- Sigma rules and playbooks work without an AI API key.
- Free plan covers up to 20 nodes.
Against
- Free plan is limited to 100 assets and three users.
- Free deployment requires self-hosting with Docker Compose.
- Enterprise pricing is custom and not listed.
The verdict
AEGIS combines threat detection, deception features, and optional AI integrations in a self-hosted open-source platform. The free tier has node, asset, and user caps; Enterprise adds broader capacity and support at custom pricing.
Who it suits
AEGIS is aimed at individuals, homelabs, and small teams able to self-host with Docker Compose. Enterprise is positioned for companies needing its listed compliance dashboard, SSO, scale, and support.
Plans and prices
Free · Open Source
5-layer detection pipeline · 122 Sigma rules · SSH + HTTP honeypots · breadcrumb traps
Read 14 Oct 2026 · alejadxr.github.io
Enterprise
Unlimited nodes · unlimited assets · unlimited users · SSO
Read 14 Oct 2026 · alejadxr.github.io
On the record
- AI and offline use
- The site says AEGIS can use OpenRouter, OpenAI, Anthropic, or Ollama for AI features, while deterministic Sigma rules and playbooks work without an AI API key.alejadxr.github.io · read 29 Sep 2026
- API authentication
- API endpoints require an X-API-Key header or a JWT Bearer token.github.com · read 14 Oct 2026
- API surface
- The deployment includes a FastAPI backend with more than 140 endpoints across 25 API routers.github.com · read 14 Oct 2026
- Changelog release
- Changelog version 1.6.1 is dated 2026-05-14 and adds ransomware defense and cloud-native CVE coverage.github.com · read 14 Oct 2026
- Changelog security coverage
- The 1.6.1 changelog lists detections for React2Shell, Next.js, Vite, Marimo, vLLM and pickle-related CVEs.github.com · read 14 Oct 2026
- Company identity
- The maker is identified publicly by the GitHub account name alejadxr.github.com · read 14 Oct 2026
- Deception
- AEGIS offers SSH and HTTP honeypots, breadcrumb credential traps, and attacker interaction profiling.alejadxr.github.io · read 29 Sep 2026
- Deployment components
- The Docker stack contains an API container, a Next.js dashboard container and PostgreSQL 16.github.com · read 14 Oct 2026
- Detection
- The site describes a five-layer detection pipeline and reports an 11/11 detection score.alejadxr.github.io · read 29 Sep 2026
- Detection performance
- The repository states that rule evaluation uses an indexed lookup taking less than 1 millisecond per event.github.com · read 14 Oct 2026
- Endpoint agent platforms
- The Rust endpoint agent is described as building for macOS arm64, Linux x64 and Windows x64.github.com · read 14 Oct 2026
- Enterprise additions
- The enterprise page lists smart honeypots, quantum-entropy and C2 detection, SBOM scanning, compliance dashboards, SSO and advanced reports.alejadxr.github.io · read 14 Oct 2026
- Enterprise support
- The Enterprise plan lists an SLA and dedicated support.alejadxr.github.io · read 29 Sep 2026
- Firewall requirement
- Real pfctl or iptables enforcement is optional, requires root or sudo and is disabled by default in favor of an in-memory firewall.github.com · read 14 Oct 2026
- Free tier limits
- The free plan is listed for up to 20 nodes, 100 assets, and 3 users.alejadxr.github.io · read 29 Sep 2026
- Initial setup
- There are no default credentials; a setup wizard at /setup creates the first administrator account.github.com · read 14 Oct 2026
- Install method
- The documented quick start clones the repository, copies .env.example and starts the stack with docker compose up -d.github.com · read 14 Oct 2026
- Integrations
- The site names OpenRouter, OpenAI, Anthropic, and Ollama as AI providers and describes shared threat intelligence.alejadxr.github.io · read 29 Sep 2026
