Documentation

Install it, point it at your traffic, and it learns.

Senua AI Cyber is self-hosted. You install a package on your own server, activate a licence, let it watch normal traffic for a while, and it starts deciding. There are no rules to write and no signatures to maintain.

What it covers

Six sections, written for the operator who has to make it work.

Getting started

From download to enforcing, in one sitting.

Install on Linux (package, self-extracting, or container)
Activate: by activation code, or by licence file offline
Capture normal traffic and induce the baseline
Connect nginx or HAProxy
Run in monitor-only, then switch on enforcement

Licensing and activation

Both paths, including fully air-gapped.

Online activation with a code
Offline activation with a licence file, no network at any point
Checking licence status and expiry
What happens at expiry: 3 days of grace, then lock
Moving a licence to a rebuilt host

Operating Shield

Day to day, and the day something happens.

Reading the dashboard and the sources view
Understanding why a source was blocked
Investigating a false-block complaint
Setting your false-block budget, and reading the derived block level
Allow lists, deny lists and exceptions
Re-capturing the baseline when your traffic legitimately changes

Alerts and integration

Getting told, and telling your other tools.

Email, webhook and chat delivery
The alert payload, field by field
Alert grouping, so one attack is not a thousand messages
What the audit log records and how to export it

Deployment and architecture

Where it sits and what it touches.

Inline via your existing reverse proxy
Fail-open behaviour and what it means for availability
Resource footprint and what to expect under load
Air-gapped and sovereign deployments
Updating, rolling back, and uninstalling

Security and data handling

Stated plainly, including the limits.

What data stays on your box (all of it)
What an alert contains, and what it never contains
Licensing: what it does and does not guarantee
Reporting a security issue to us

Where the measurements are

Every figure we publish names the dataset it came from.

Shield's results are on the Shield page with their conditions beside them, and the full runs are on the benchmarking page, on public datasets you can download and re-run yourself.

Walk through it with the team.

Every subscription comes with the full documentation set, a guided setup and a direct line to the team that built it. Tell us what you need to watch.

Talk to us Read the pricing