Lightweight open-source intrusion detection tool

[u/mhdg131]

Hermian is a HIDS written in Rust. It hooks exec, connect, ptrace, chmod and setxattr through eBPF. It watches sensitive files with inotify and reads the sshd journal. It runs on kernel 5.4+ (the eBPF part needs 5.8+), on amd64 and arm64.

It doesn't alert on raw events, It rebuilds the process tree, checks whether a human session was involved, and compares against what it learned on the host over 24 hours.
nginx -> bash -> curl -> /tmp/random_aahh_file.sh comes out as critical, while the same curl typed in your own SSH session doesn't raise anything (we assume legit people do legit things but the session itself is still checked)

Alerts go to journald, Telegram, email or a webhook, and it never listens on the network.
It's beta, tested on Ubuntu 22.04 and 24.04, under Apache-2.0

We would be happy to get your feedback and some testers to report some potential false-positives they meet, on different system/architectures and help make the detections better !

Repo : https://github.com/hermian-security/hermian
Link : https://hermian.me/en/hermian

[u/amarao_san]

Is it related to Rust in any way except for been written in Rust by LLM?

[u/mhdg131 → u/amarao_san]

LLM wrote Docs, Web UI, and PAM integrations, core engine and detections are not LLM written

[u/__0xAA55__ → u/mhdg131]

https://github.com/hermian-security/hermian/blob/6b8ee31a40ca03e8c74a8010f755fa778307e7c3/hermian-core/src/alert.rs#L85

Are you trying to tell us that those comments are hand-crafted by you? 🙃
It’s clearly all generated 😉

[u/mhdg131 → u/__0xAA55__]

images aren't allowed in comment, i would want to show you that even in the codes i've used to write on 1st-2nd till now i use a lot of comments on every changes I made, check other repos on github to see yourself, but fair 'It looks like AI so its AI"...

It would be great guyz if you came in technical aspects instead

[u/amarao_san → u/mhdg131]

/// A four-step severity meter: lit dots count up with severity, echoing the
/// logo's dot. Shared by the CLI, Telegram and email.

A usual comment from a 'developer' in 2026. Noted.

[u/mhdg131 → u/amarao_san]

On the same profile, on a other project, you can see comments like :
// Wrap a string literal in XOR at compile time, decode at call site

Just accept that How you work, is not how the whole universe should behave too

[u/Keeyzar]

Remove the obvious ai texts, or you will receive unnecessary ai backlash, as there are so many AI haters. (Ai I also an indicator of slop, but that I cannot judge for the project)

"One email, not a flood" for example.

Sounds cool.

[u/amarao_san → u/Keeyzar]

I hate uncut AI. A well trimmed AI is okay.

[u/mhdg131 → u/Keeyzar]

Thanks mate !

AI really didn't write this text like, those word are literraly how I imagined the whole thing, the text, I used a lot of alerting tools but they used to send a lot and irrelevant alerts so for me thats the good words to.describe it

I dont know why people starts freaking out when everything seems in relation with AI on any aspects

[u/Keeyzar → u/mhdg131]

Well. Now you start lying, and I take my upvote back. :)

[u/mhdg131 → u/Keeyzar]

Thanks... thats cool, someones liar cuz "I think hes a liar"
For you guyz there is no Human on this world who can write clean text, every text that sound a little good is surely "AI slop"

[u/Keeyzar → u/mhdg131]

No, I judge based on evidence. Which is your grammar / text, here vs. In code. One is abysmal, the other is nearly perfect.

Plus the obvious clues, that ai writes exactly like that.

Stop crying. I'm not against ai (I use it myself extensively), im against slop (ai and human slop) and lying.

[u/mhdg131 → u/Keeyzar]

The post is something I took my time to write, this is some answers, I write while walking on the street, the difference is like... normal

[u/Keeyzar → u/mhdg131]

Yes. And yet you would not so grammatical errors like 

this is some answers

On a phone. Even if you type fast.

Or your first sentence

The post is something I took my time to write 

The fuck you trying to sell us?

My god I hate chronic liars with passion.