Air-Gapped Operation

Athena is designed to run indefinitely on a fully isolated network — no internet, no telemetry, no license check-ins, no phone-home.

No phone-home#

Every part of a default Athena deployment resolves locally. Nothing reaches outside the isolated network during normal operation:

The database is local SQLite by default (Data Source=athena.db) — no external database service to reach.
Agents connect outbound-only to the server; there is no external message broker or cloud relay in the path.
The Root CA and all agent certificates are generated locally on first run.
Packages, session recordings, agent binaries, and audit logs are all stored on local disk.

None of these require any external service.

Designed for isolation

A default install has no outbound dependency — no telemetry, no license check-ins, and no update servers to reach. Athena is built to run indefinitely on a network that never touches the internet.

Offline Windows Update scanning#

For patch visibility without internet, the server hosts Microsoft's offline scan catalog, wsusscn2.cab. Agents use it to evaluate which updates are missing entirely offline. See Windows Update Management for the complete workflow — catalog upload and signing, on-demand and scheduled scans, and reviewing results.

Upload and manage the catalog via the api/updates endpoints:

Method & path	Purpose
`POST api/updates/wsusscn2.cab`	Upload the offline scan catalog
`GET api/updates/wsusscn2.cab`	Download the current catalog
`GET api/updates/wsusscn2.cab/info`	Inspect catalog metadata (size, date)
`DELETE api/updates/wsusscn2.cab`	Remove the catalog

You can also manage it in the console under Settings → Agent → WSUS. Agent-side scanning is opt-in via Agent:UpdateScanner:Enabled (false by default).

The CAB is large (hundreds of MB). Transfer it onto the network like any other artifact — see Transferring artifacts onto the network.

Transferring artifacts onto the network#

Download the appliance image (OVA or VHDX) on a connected machine, check its SHA-256, and carry it across the air-gap boundary (USB, data diode, etc.). Import it on the isolated network as described on the Downloads page. Appliance updates are single signed files and cross the boundary the same way.

Bring the rest of the artifacts across the same way:

The agent installer bundle (from Agent Enrollment).
The wsusscn2.cab offline scan catalog, if you use offline update scanning.

TLS without public CAs#

Public certificate authorities are unreachable on an isolated network, so issue the server certificate yourself. Use an internal PKI or a self-signed PFX for the server certificate.

On agents, choose one of:

Install your CA into the host trust store, so the self-issued server certificate validates normally; or
Set ValidateServerCertificate=false for self-signed setups.

Athena's own PKI is independent

Athena's agent PKI (the local Root CA and the certificates it issues to agents) is independent of any public CA. The server TLS certificate above is a separate concern from the agent identity certificates.

The virtual appliance needs no outbound access and is the way to deploy Athena on an isolated network.