XCloak Documentation
Everything you need to install, run, configure, and extend XCloak — a self-hosted platform combining NGFW, SIEM, EDR, SOAR, ITDR, and MDM in one system.
New here? Start with Installation — you can have alerts flowing in about five minutes.
Where to go
| Section | What's in it |
|---|---|
| Installation | Prerequisites, Docker Compose, first run, self-serve signup |
| Architecture | How the frontend, backend, agent, and datastores fit together |
| Detection Engine | Sigma rules, behavioral detectors, YARA, JA3, threat intel feeds |
| Deployment | Docker Compose, Kubernetes/Helm, TLS, backups |
| Configuration | Every environment variable, explained |
| Agent | Installing and managing the endpoint agent |
| Using the Dashboard | Alerts, incidents, playbooks, rules, hunting |
| API Reference | Authentication and key REST endpoints |
| Development Setup | Running the backend and frontend locally, contributing |
Tech stack, at a glance
- Backend — Go, Gin, PostgreSQL 16, Redis, Kafka
- Frontend — Next.js, TypeScript, Tailwind CSS
- Agent — single Go binary, Linux and Windows
- Deployment — Docker Compose or Kubernetes/Helm
License
XCloak is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0) — free to use, modify, and self-host with no agent limits. If you offer XCloak as a hosted service to others, you must release your modifications under the same license. See the LICENSE file for the full text.