Get DENIS

Try the demo (no network access needed)

1. Download the binary for your platform from the latest release. Use denis-x86_64-unknown-linux-gnu or denis-aarch64-unknown-linux-gnu for Debian, Ubuntu or Raspberry Pi OS, denis-x86_64-unknown-linux-musl or denis-aarch64-unknown-linux-musl for Alpine or any other Linux (see which file is for whom), and denis-aarch64-apple-darwin (Apple silicon) or denis-x86_64-apple-darwin (Intel) for macOS.
2. Run:

   $ mv denis-* denis && chmod +x denis
   $ ./denis demo --db demo.db load && ./denis serve --db demo.db --insecure-no-auth

3. Open http://localhost:8080

macOS: a file downloaded in a browser may need xattr -d com.apple.quarantine denis first.

• Loads a fictional company: 42 devices, open alerts, findings and an OT production line
• No packet capture, no login, nothing sent on your network
• The console is reachable from this machine only
• Remove it any time. It is a single database file.

Install as a Linux service

$ curl -fLO https://github.com/stefanmesaros/denis/releases/latest/download/install.sh
$ less install.sh      # it runs as root: read it first
$ sudo bash install.sh

The installer verifies the release signature and checksum, sets DENIS up as a service running as an unprivileged denis user, picks a free port and prints the address and a one-time admin password. Afterwards, updates are one click in the console. Since 4.2, security updates of the version line you run install by themselves on new installations, with the same signature checks, a backup and automatic rollback; switch that off in Settings → System if you want to decide yourself.

Supported: Linux on x86-64 and ARM64, with systemd (Ubuntu, Debian, Raspberry Pi OS, RHEL-family, Fedora, Arch and others) or OpenRC (Alpine). On Alpine the service is /etc/init.d/denis, with its log in /var/log/denis; install bash, curl and openssl first and run the installer as root. On a system with neither systemd nor OpenRC the installer stops and points to --no-service, which installs everything except the service and prints the command to start DENIS under your own supervisor.

The installer picks the build for you: Debian, Ubuntu and Raspberry Pi OS get the usual build, which uses the system’s libpcap; Alpine and other systems get the static build, which has everything built in. A static installation updates to the static build of the next release. OpenRC has so far been tried in a container, not on a booted Alpine machine.

The same installer sets up a remote agent with --agent. On the master, Sites → Add agent creates the agent’s token and prints the command with everything filled in. Agents can then be updated from the master’s console. See the deployment guide.

Run the binary directly (Linux or macOS)

$ ./denis run

Prints a one-time admin password; open https://localhost:8080. The certificate is self-signed by default, and you can trust the DENIS CA or install your own.

Capture permission

• Linux: sudo setcap cap_net_raw,cap_net_admin=eip ./denis
• macOS: read access to /dev/bpf*, or run with sudo

The usual Linux build (…-linux-gnu) needs the libpcap runtime (libpcap0.8). The static build (…-linux-musl) needs nothing installed.

Docker

Each release is also an image, ghcr.io/stefanmesaros/denis:4.4.3 (Linux x86-64). Monitoring a real network from a container needs host networking and two Linux capabilities, and packet capture inside a container has not yet been verified on a real network. The Docker guide has the demo, the collector and the remote agent.

Where to run it

• Discovery works from any machine on the segment.
• Traffic baselines and OT visibility need a mirror/SPAN port, a tap or the gateway, started with --flows (or --profile ot).
• Run one collector per segment.

Verify your download

Every release includes SHA256SUMS and a signature SHA256SUMS.sig. Compute the checksum of the file you downloaded and compare it with the line for that file:

$ shasum -a 256 denis-aarch64-apple-darwin
$ grep denis-aarch64-apple-darwin SHA256SUMS

The installer and the self-updater check the signature automatically. Since 4.1.1 install.sh is listed in the signed SHA256SUMS too, so you can check the installer itself before you run it as root. The deployment guide has the commands that check the signature with openssl.

Platforms

Which Linux file to take, if you do not use the installer:

• …-unknown-linux-gnu: Debian, Ubuntu and Raspberry Pi OS. Uses the system’s libpcap (libpcap0.8).
• …-unknown-linux-musl (static, since 4.1.1): Alpine, and any Linux where the usual build does not start because libpcap is missing or named differently. Everything is built in, nothing else needs to be installed.
• x86_64 is for ordinary PCs and servers, aarch64 for ARM64 machines such as a Raspberry Pi 4 or 5 with a 64-bit system.

License

DENIS Community is free for personal, non-commercial use on a single installation monitoring up to 100 devices, under the DENIS Community License. It is distributed as signed, pre-built binaries. Read the license →

An organisation may use the Community edition free for 30 days from its first installation, on up to 100 devices, to evaluate and demonstrate DENIS; DENIS does not count the days. Running its operations on DENIS, or any other organisational use, needs a separate commercial license. See information for organisations.

Next

• Guide: install on a small Linux machine
• Quick start
• Deployment guide
• Docker guide
• Release notes
• All releases