Active Defense: Configuring the Vigil Immune System

Backup and Recovery alone are reactive measures. To build a truly resilient infrastructure, you must anticipate threats before they compromise your data.

StateWarden integrates proactive security directly into its core with Vigil: The Active Defense Engine.

Unlike traditional scanners that rely on intrusive cloud APIs, Vigil acts as a self-contained "Immune System". It aggregates global Threat Intelligence (OSV, NVD, MalwareBazaar) into local Bloom Filters, executing high-speed, zero-knowledge threat triage directly within your private Realm.

This guide details how to configure Vigil to automatically detect and report vulnerabilities and malware across your infrastructure.

1. The Vigil Architecture

Vigil operates on a three-tier model, prioritizing speed and data privacy:

• The Aggregator (Control Plane): StateWarden syncs gigabytes of threat feeds directly into our centralized PostgreSQL databases.
• The Bloom Filter (Memory): Vigil compiles millions of malware signatures into ultra-fast, probabilistic data structures (Bloom Filters) loaded into RAM.
• The Scanner (Agent): When commanded, the local Agent performs an Inventory Scan (hashing binaries and cataloging installed software) and transmits the telemetry to Vigil.

The result is instantaneous threat detection. The Agent never queries the cloud, and Vigil never leaves your private network.

2. Enabling Active Defense Scans

Vigil scans are decoupled from backup tasks to ensure maximum performance. Scans are scheduled and executed via dedicated policies.

1. Navigate to the Security Policies section of your Realm.

2. Under Active Defense (Vigil), you will find two primary options:

   • Vulnerability Scanning (CVE): Instructs the Agent to catalog OS packages (dpkg, rpm, Windows Registry) and match them against known OSV/NVD vulnerabilities.
   • Malware Scanning (Hashes): Instructs the Agent to calculate SHA256 hashes of critical executables and compare them against the MalwareBazaar feed.

3. Set the scan frequency (e.g., Daily, Weekly) and Save Policy. The Artemis orchestrator will begin dispatching SECURITY_SCAN tasks to your Devices.

3. Triaging Threats in the Dashboard

When Vigil detects a compromise, it immediately updates the Security Dashboard.

The Risk Matrix

1. Navigate to Vigil Triage in the main sidebar.
2. You will see a consolidated list of all active Findings across your Realm.
3. Findings are categorized by Severity (0-10 CVSS scale) and visually tagged (Critical, High, Medium, Low).
4. Device Impact: The dashboard highlights exactly which Devices (e.g., web-server-01, win-desktop-ceo) contain the compromised package or malicious file.

4. Managing False Positives (Suppression)

Security feeds are occasionally noisy. An outdated version of vim on a test server might flag as a High severity CVE, but you may determine it is not exploitable in your specific environment.

StateWarden provides a granular Suppression Engine to handle false positives and manage your Risk Matrix effectively.

How to Suppress a Finding

1. In the Vigil Triage view, locate the specific finding (e.g., UBUNTU-CVE-2025-55158).
2. Click the Suppress (Ignore) action button next to the entry.
3. Note: Only users with the SUPPORT_L1 or ADMIN RBAC role can suppress findings.
4. The finding is immediately moved to the "Ignored" tab and will no longer count towards the Device's overall Risk Score.

The Self-Healing Matrix

Vigil is designed to self-heal. If you update the vulnerable software on the target device, the next scheduled Vigil scan will automatically detect the patched version. The Agent will transmit the new inventory, and Vigil will auto-resolve the finding in the database, removing it from your active Triage list permanently.

StateWarden: Resilience Engineered.