LTFI-Aegis · security platform for Linux fleets · v0.3.4
LTFI-Aegis pairs a single signed eBPF agent — kernel-deep detection and active prevention on each Linux node — with a console that turns the whole fleet into one operations picture: attack surface, layer-7 traffic, SOC, threat hunting, exposure, posture, and compliance.
Included with Kief Studio managed hosting · Per-node & OEM/datacenter licensing · Air-gap friendly · Signature-verified releases
What it is
Most security stacks are a sensor you buy and a SIEM you rent, glued together by you. LTFI-Aegis ships both halves as one product: the agent that sees and stops things on the node, and the console that correlates, scores, and lets you act across every node at once.
A single ~4.7 MB eBPF agent replaces the six-tool patchwork — log shipping, host metrics, syscall audit, IP banning, file-integrity, blocklisting — and adds active prevention those tools never had.
Every agent reports to one console. Instead of per-box guesswork, you get fleet posture, external exposure, live traffic, incidents, and compliance evidence in a single pane — with the controls to respond.
How it works
No rip-and-replace and no SIEM integration project. Deploy the agent, let it learn, promote to enforce, and operate the whole estate from the console.
One signed static binary and a config block per node. No kernel modules, no out-of-tree drivers. Telemetry starts flowing immediately.
Each node runs in learn mode for 48–72 hours, modeling what normal looks like before anything is enforced.
Flip to enforce. Active prevention is on at the kernel; the console shows enforce/learn state across the fleet.
Watch posture, hunt, triage incidents, score exposure, and produce compliance evidence — across every node, in one place.
Capabilities
Each capability below is part of the same platform, driven by the same agent telemetry — no extra sensors, no extra vendors. Here's what each one is, how it works, and who it's for.
Fleet command
The dashboard is mission control: incident severity trends, open incidents by module, top threats, fleet exposure, and a live rail of every node and its mode.
A real-time command view of the whole fleet — every node's mode (enforce/learn), posture score, module health, and the incidents and threats that need attention now.
Each agent streams health and behavioral telemetry to the console, which rolls it up into fleet-wide posture and drill-downs to any single node's services, vulnerabilities, and self-test results.
Platform and infrastructure teams who need one screen to answer "is the fleet healthy, and what's on fire?" without SSH-ing box to box.
External attack surface
Continuous external scanning of your domains and endpoints — security and SEO scores, nuclei findings by severity, exposed secrets, subdomains, TLS posture, and a scan pipeline.
External Attack Surface Management built into the platform — the outside-in view of every web property you run, scored and tracked over time.
A scan pipeline enumerates targets and subdomains, runs nuclei templates, checks TLS and security headers, and flags exposed secrets — feeding findings and trends straight into the console.
Teams responsible for public-facing assets — agencies, hosts, and security owners who need to catch exposure before an attacker does.
Layer-7 traffic analytics
Real-time L7 analytics across the fleet — request volume and actor mix, geography, and a security view that shows exactly what was blocked at the edge and what got through.
A layer-7 traffic lens that classifies every request — verified human, bot, AI crawler, automation, or attacker — and shows the security disposition of each.
Edge and agent telemetry are classified and aggregated into live timeseries, geography, and a findings feed where each attack shows its result: blocked at edge, deflected, or served.
Operators defending public sites and APIs who need to prove their edge is absorbing abuse — and quantify the human traffic underneath the noise.
SOC & incident response
A working SOC view: MTTD/MTTR and SLA metrics, a live alert queue, analyst workload, disposition breakdown, and incidents you can drive from open to resolved with a timeline and response actions.
Security operations and incident response in the console — alert queue, case management, response playbooks, and the metrics that tell you how fast you detect and resolve.
Agent and module detections become alerts and incidents; analysts claim, escalate, run playbooks, and disposition them, while the console tracks MTTD, MTTR, SLA compliance and workload.
MSSPs and in-house security teams who want a SOC workflow tied directly to the same agents enforcing on the fleet — not a disconnected ticketing tool.
Threat hunting
Query fleet-wide event logs with one-click presets or custom filters — cryptoshield blocks, first-seen egress, auth failures, privilege escalation — with severity and module breakdowns and export.
Interactive threat hunting over the telemetry every agent produces — presets for common hunts plus custom queries by node, module and severity.
Hunts run against the fleet's event store and return matching events with severity/module distributions; results export to CSV or JSON for reporting or escalation into a case.
Analysts and responders who need to ask the fleet a question — "show me first-seen egress in the last 7 days" — and get an answer in seconds.
Exposure, posture & compliance
A composite exposure score per node from vulnerabilities, compliance, posture, surface and behavior — plus posture by domain and per-framework compliance status you can hand to an auditor.
Risk made measurable: an exposure score that combines vulnerabilities, compliance failures, posture, attack surface and behavioral anomalies into one number per node and for the fleet.
The console weighs each factor from agent and scan data, trends it over time, and maps control status to SOC 2, NIST 800-171, CMMC, PCI and HIPAA evidence.
Leaders and compliance owners in regulated industries who need to show risk going down and produce audit evidence without a tool-stitching project.
Asset registry
A unified registry that merges fleet hosts and services with externally-discovered domains and endpoints — every asset classified by access zone, from public to internal.
A single source of truth for assets — hosts, services, domains and endpoint findings — with access-zone classification so you know what's public, meshed, or internal.
Fleet collectors and the EASM pipeline feed one registry, linking domains to their endpoints and nodes, so external exposure and internal inventory live in the same place.
Anyone who's ever asked "what do we actually run, and which of it is exposed?" — security, ops, and compliance, working from the same list.
Drive it yourself
No form wall, no sales call. Open the live console and click through fleet defense, attack surface, traffic, SOC, hunting, exposure and the asset registry — running entirely on fake data.
Who it's for
LTFI-Aegis is the security layer included with Kief Studio managed hosting — and a platform datacenter operators, MSPs and OEMs can license to run on their own estate.
If Kief Studio runs your infrastructure, Aegis is already there — every node defended, the whole estate visible, no extra product to buy or operate.
Run a real SOC workflow over a multi-tenant fleet — fleet defense, hunting, and case management on the same agents that enforce, with per-client visibility.
Operators and product teams can license Aegis per node or embed the agent in their own offering — a signed, self-updating supply chain you can stand behind.
Field-proven
LTFI-Aegis isn't a lab project. It runs in enforce mode across Kief Studio's managed production fleet, protecting real client workloads every day.
During a sustained campaign against a managed-hosting client — roughly 1.37 million inbound requests from a residential-proxy botnet — Aegis' host-runtime integrity monitoring and behavioral telemetry confirmed, with evidence, that nothing executed on the box while edge controls absorbed the volume. Inbound enumeration, never a compromise.
— Anonymized incident. The traffic was external, from residential proxies; the host was the target, never the source, and was never breached.
Who builds it
LTFI-Aegis is part of the LTFI ecosystem, developed and operated by Kief Studio LLC — a family-owned Massachusetts technology firm founded in 2022. We don't resell security software; we build the platform we run, and we run it in production.
Co-founder & CTO
Twenty years of technology and infrastructure engineering. Writes the Rust and eBPF behind the agent and the console behind the fleet — and operates the production estate it protects.
Co-founder & CEO
Full-stack developer and operator. Leads product and the business behind LTFI, and sits on the board of an enterprise cybersecurity platform.
Questions, answered
Start with a slice
Tell us a little about your fleet and we'll scope a pilot — no commitment to the whole estate on day one. Prefer to look first? Drive the live demo →
What happens next: we reply within one business day to scope your pilot. No sales script.
