Installation

# Download
curl -fsSL https://github.com/oximyhq/sensor/releases/latest/download/oisp-sensor-x86_64-unknown-linux-gnu.tar.gz | tar xz

# Install
sudo mv oisp-sensor /usr/local/bin/
sudo chmod +x /usr/local/bin/oisp-sensor

# Set capabilities (allows running without full root)
sudo setcap cap_sys_admin,cap_bpf,cap_perfmon,cap_net_admin+ep /usr/local/bin/oisp-sensor

oisp-sensor --version

# Check kernel version (need 5.0+)
uname -r

# Check BTF support (required)
ls /sys/kernel/btf/vmlinux

# Check if debugfs is mounted
ls /sys/kernel/debug/

# Download .deb package
curl -LO https://github.com/oximyhq/sensor/releases/latest/download/oisp-sensor_amd64.deb

# Install
sudo dpkg -i oisp-sensor_amd64.deb

# Start service
sudo systemctl enable --now oisp-sensor

# Download .rpm package
curl -LO https://github.com/oximyhq/sensor/releases/latest/download/oisp-sensor.x86_64.rpm

# Install
sudo dnf install ./oisp-sensor.x86_64.rpm

# Start service
sudo systemctl enable --now oisp-sensor

oisp-sensor check

OISP Sensor System Check
========================

Platform: linux x86_64 (supported)

Kernel Version:    6.8.0 [OK]
BTF Support:       /sys/kernel/btf/vmlinux [OK]
eBPF Filesystem:   /sys/fs/bpf [OK]
Permissions:       CAP_BPF+CAP_PERFMON set [OK]

SSL Libraries:
  /usr/lib/x86_64-linux-gnu/libssl.so.3 [FOUND]

Result: READY

docker run --privileged -p 7777:7777 ghcr.io/oximyhq/sensor

version: '3.8'
services:
  oisp-sensor:
    image: ghcr.io/oximyhq/sensor:latest
    privileged: true
    ports:
      - "7777:7777"
    volumes:
      - ./config.toml:/etc/oisp/config.toml
      - ./events:/var/log/oisp

# Clone repository
git clone https://github.com/oximyhq/sensor.git
cd oisp-sensor

# Build eBPF programs
cd ebpf && cargo build --release && cd ..

# Build frontend
cd frontend && npm install && npm run build && cd ..

# Build sensor
cargo build --release

# Install
sudo cp target/release/oisp-sensor /usr/local/bin/