Agent

The agent is a single Go binary with no runtime dependencies, built for Linux and Windows. It runs 15 autonomous collectors in goroutines and responds to server-dispatched task commands.

Installation

Download a pre-built binary (v0.2+)

# Linux amd64
curl -Lo xcloak-agent-desktop \
  https://github.com/The-Abhishek1/XCLOAK-SECURITY-SUITE/releases/latest/download/xcloak-agent-linux-amd64
chmod +x xcloak-agent-desktop

# Linux arm64
curl -Lo xcloak-agent-desktop \
  https://github.com/The-Abhishek1/XCLOAK-SECURITY-SUITE/releases/latest/download/xcloak-agent-linux-arm64
chmod +x xcloak-agent-desktop

# Windows — download xcloak-agent-windows-amd64.exe

Build from source

cd xcloak-agent-desktop
go build -o xcloak-agent-desktop ./main.go

# Windows cross-compile
GOOS=windows GOARCH=amd64 go build -o xcloak-agent-desktop.exe ./main.go

First run

XCLOAK_SERVER=https://xcloak.yourdomain.com ./xcloak-agent-desktop

On first run the agent prompts for an install token (generate one at Agents → Add Agent → Install Token in the UI). After registration the agent token is saved to ~/.config/xcloak-agent-desktop/token and reused on every restart.

Agent environment variables

Variable	Default	Description
`XCLOAK_SERVER`	—	Backend URL (required on first run)
`LOG_FORMAT`	`text`	`json` for structured logs
`LOG_LEVEL`	`info`	`debug` / `info` / `warn` / `error`
`XCLOAK_DISABLE_SELF_UPDATE`	—	Set to `1` to skip update checks

What it collects

The agent runs 15 autonomous collectors in goroutines with jitter-staggered intervals.

Collector	Linux interval	Windows interval	Notes
Processes	30 s	30 s	PID, PPID, name, cmdline, exe path, UID/GID
Connections	30 s	30 s	`/proc/net` inode→PID (Linux); netstat+tasklist (Windows)
Services	60 s	60 s	systemd unit state (Linux); Windows services
Users	10 min	10 min	Groups, sudo, SSH keys, last login, account status
Packages	6 h	6 h	dpkg→rpm→pacman→snap→flatpak→pip3 (Linux); WMIC→registry→winget (Windows)
Auth logs	2 min	2 min	`/var/log/auth.log` (Linux); Windows Security Event Log
auditd	30 s	—	`/var/log/audit/audit.log` execve events
File hashes	1 h	1 h	SHA-256 + MD5 inventory
FIM	real-time	real-time	Hash + mode + owner + mtime; watched paths configurable
Registry	—	1 h	Run/RunOnce persistence keys
Cron jobs	1 h	1 h	`/etc/crontab` + `/etc/cron.d/*` + user crontabs (Linux); schtasks (Windows)
Kernel modules	30 min	30 min	`lsmod` (Linux); `driverquery` (Windows)
SUID/SGID scan	6 h	—	Walks `/usr /bin /sbin /opt /home` for SUID/SGID bits
Disk usage	5 min	5 min	`/proc/mounts` + `syscall.Statfs` (Linux); WMIC/Get-PSDrive (Windows)
eBPF TCP events	real-time	—	Kernel 5.8+ required; degrades gracefully on older kernels

FIM — File Integrity Monitoring

The agent monitors a default set of security-critical paths and reports any create, modify, delete, or permission change events. Each event includes file path, change type, old and new SHA-256 + MD5 hash, file mode, UID, GID, and modification timestamp.

Default watched paths:

/etc/passwd        /etc/shadow         /etc/sudoers
/etc/ssh/          /etc/cron*          /etc/hosts
/etc/ld.so.preload /etc/pam.d/         /etc/systemd/system/
/bin/              /sbin/              /usr/bin/
/usr/sbin/         /root/              /tmp/

Add custom paths by setting FIM_EXTRA_PATHS (comma-separated) in the agent environment.

Auto-quarantine: When a FIM violation is detected on a critical system path, the backend automatically creates a quarantine_file task in pending approval. The file is not moved until an operator approves at Tasks → Pending Approval.

Server-dispatched tasks

Task	Description
`collect_processes`	Snapshot running processes
`collect_connections`	Active network connections with PID enrichment
`collect_packages`	Full installed package inventory
`collect_users`	User inventory with groups, sudo, SSH keys
`collect_services`	Running service states
`collect_auth_logs`	Read `/var/log/auth.log`
`collect_file_hashes`	SHA-256/MD5 file inventory
`collect_cron_jobs`	Cron job / scheduled task inventory
`collect_kernel_modules`	Loaded kernel modules / drivers
`collect_suid_binaries`	SUID/SGID binary scan
`collect_disk_usage`	Disk capacity per mount point
`fim_scan`	File integrity check — hash + mode + owner + mtime
`vulnerability_scan`	Collect packages for server-side CVE matching
`kill_process`	Kill a process by PID
`isolate_host`	Block all traffic except XCloak server (requires approval)
`quarantine_file`	Move file to quarantine directory (requires approval)
`execute_script`	Run bash/sh/python3 script, stream output
`apply_firewall_rules`	Apply iptables rules from XCloak
`restore_file`	Restore a quarantined file to its original path

Destructive tasks (kill_process, isolate_host, quarantine_file) require human approval before executing. Approval is required at Tasks → Pending Approval.

Self-update

The agent checks for a newer release on startup. Releases are ed25519-signed; the agent verifies the signature before executing any update binary. Set XCLOAK_DISABLE_SELF_UPDATE=1 to disable.

Task expiry

Tasks not actioned within 15 minutes are automatically cancelled. This prevents a backlog of stale destructive commands from executing hours later.