Vaigilmanual

Get started

From nothing to a running console and your first detections.

In the consoleTodayGet startedFind

  1. Build it

    Go 1.27 or later is the only requirement. There is nothing else to fetch.

    git clone https://github.com/Vaigil/Vaigil vaigil && cd vaigil
go build -o vaigil ./cmd/vaigil

  2. Create a store and its first administrator

    ./vaigil init --admin you@example.com

    It prints a one-time link that adds that person's passkey and does nothing else. There is no default password and no default account.

  3. Start the console and add your passkey

    ./vaigil serve

    The console listens on 127.0.0.1:8080. Open the link init printed, add a passkey, and you are signed in.

  4. Follow Get started

    Get started in the console walks four things: bring events in, decide what counts as wrong, know the estate, and decide who else may do what. It reads the store rather than telling a story, so each step is ticked when it is done.

From a terminal

Once anybody is an administrator, a command run from a terminal needs a token, which proves who is running it. Issuing an administrator's token takes a second administrator, so ask for yours, approve it in the console, where Approvals lists it, and collect it within a day:

vaigil token issue you --principal you@example.com --role admin
vaigil pending redeem ID

The token is printed once. Keep it in ~/.vaigil/token, or pass it as VAIGIL_TOKEN or --token. The same first steps, from the terminal:

vaigil vault enable
vaigil connect add okta --org example
VAIGIL_CONNECT_SECRET=... vaigil connect secret okta
vaigil collect run
vaigil detect pack install
vaigil detect run
vaigil estate build
vaigil auth enrol sam@example.com
vaigil auth grant sam@example.com analyst

See Connectors and feeds, Detections, Estate and workforce and People for each.

Today

The first screen after signing in is Today: what is waiting for you to decide, then what is wrong in the parts of the estate you work in.

Find

The box in the bar finds a screen or a setting by the words you would use for it. There is no query syntax: every word is looked up, and a colon, a quote or a bracket is part of a word.