Download Athena

Virtual appliance#

A ready-to-run VM built on hardened Flatcar Container Linux LTS with Athena preinstalled. You import it, answer five questions on the VM console and sign in from a browser. It ships with a 60 GB disk and a built-in trial licence — no internet connection needed. The trial runs to a fixed end date per release (shown with each download), not from the day you install it.

# Or with PowerShell
New-VM -Name Athena -Generation 2 -MemoryStartupBytes 4GB `
  -VHDPath C:\VMs\athena-appliance.vhdx -SwitchName "<your switch>"
Set-VMFirmware -VMName Athena -EnableSecureBoot Off
Set-VMProcessor -VMName Athena -Count 2
Set-VMMemory -VMName Athena -DynamicMemoryEnabled $false
Start-VM Athena

First boot and the appliance console

On first boot the VM console runs a short wizard:

1. Network — DHCP, or a static IPv4 address with gateway and DNS servers.
2. Host name and an optional DNS domain.
3. NTP servers.
4. Time zone — an IANA name such as Europe/London (default UTC).
5. Database — built-in SQLite, or the built-in PostgreSQL 16 for larger fleets.

Press Enter to keep a default; everything can be changed later from the same console. New to Athena? The Beginner Guide walks through each question.

It then shows the web address and the initial admin password. The hostname and IP address go into the server's certificate and web address automatically, so agents can enroll by name or by IP.

After setup the VM console shows a restricted admin menu, never a shell: status, network, hostname, NTP, proxy, switch the database to the local PostgreSQL, restart services, support bundle (logs and configuration with secrets removed; an Admin can also download it from the web API), updates, time-limited support SSH, factory reset, and reboot / shutdown. Support SSH switches itself off, and using it permanently marks the appliance as “OS accessed”. Switching to PostgreSQL is one-way (a backup is taken first). Factory reset erases all data, including the certificate authority, so enrolled devices cannot reconnect afterwards — copy any backup off the appliance first.

Updates — offline, signed, with automatic rollback

Each update is a single file, athena-update-<version>.tar (≈ 1 GB), that carries everything: the Athena server, appliance configuration, agent installers, PostgreSQL and the operating-system update, including OS security fixes. One file updates the application and the OS together, and the appliance never needs internet access.

• Signed: every bundle is signed with a dedicated SealGrid update key, kept offline and separate from Athena's certificate authority. A bundle with a bad signature or a single changed byte is refused before anything is touched. Downgrades and re-applying the same version are refused too.
• Apply: in the web console, Settings → Appliance → Appliance updates: Upload bundle, Verify, Apply. Or upload it through the REST API (PUT /api/appliance-updates/<file>, Admin; audited) and choose 13) Updates in the appliance console menu.
• What happens: verify → pre-flight checks → database backup (always taken and kept) → the new OS goes onto the inactive partition → reboot → health check → commit.
• Automatic rollback: the update is kept only if Athena is healthy after the reboot and stays healthy for two minutes. Otherwise the appliance restores the previous OS, Athena version and database by itself.
• Agents are not updated automatically. Roll the new agent version out from the web console when you are ready.

Security and hardening

What the appliance does to reduce its attack surface:

• Read-only, integrity-checked OS: the operating system is mounted read-only and verified by dm-verity. Flatcar's own auto-updater is switched off; the appliance never contacts an update server.
• Firewall: inbound traffic is dropped by default. Open: TCP 8443 (web console and API), TCP 8444 (agents) and, unless you switch it off on the VM console, Athena's built-in remote-control server (TCP 21114, 21116, 21117 and UDP 21116). The metrics port (9464) is closed by default. IP forwarding is off, and the container runtime API is not on the network.
• No SSH: SSH is off. Support SSH can be switched on only from the VM console, for a limited time with a one-time password, and every use is recorded permanently.
• Hardened server container: non-root, no Linux capabilities, read-only root filesystem, no privilege escalation.
• No default passwords: OS accounts are locked, and the Athena admin password is generated per install. Certificates, keys and IDs are created on first boot, so cloned VMs never share an identity.
• SELinux enforcing: on from the first boot; Flatcar's policy confines the containers.
• Kernel lockdown: integrity mode blocks writes to kernel memory.
• CIS Level 1: the OS settings follow the CIS Distribution Independent Linux Level 1 benchmark where it applies (there is no CIS benchmark for Flatcar), and each release is checked against it, together with Docker Bench and Lynis.
• Drift detection: managed files are checked hourly and at boot; hand edits show on the VM console and in support bundles.
• Audit: auditd and a persistent system journal record OS-level access and changes.
• Signed updates with automatic rollback — see Updates.

Each release comes with:

• SBOMs (SPDX 2.3 JSON) for the Athena server, the PostgreSQL image, the Windows, Linux and macOS agents, the appliance's own files, and Flatcar's published SBOM for the exact OS release.
• A CVE report (JSON and Markdown) with counts by severity and the fixed-in version of every Critical and High finding. A release is blocked if Athena's own components have a fixable Critical. Findings in upstream components (the PostgreSQL image, Go binaries inside Flatcar) are listed until upstream fixes them. Flatcar's OS packages (kernel, glibc, OpenSSL, systemd) are covered by Flatcar's security advisories, not by the scan.
• A hardening statement covering all of the above in detail.

The SBOMs and CVE report are also inside every signed update bundle. They will be published here with the first release.

Licensing

• Trial: each appliance release includes a trial licence valid until a date published with each release. Download a current release for the latest end date.
• Full licence: a licence file (.lic.cer) from SealGrid. Upload it in Settings → License; it takes effect immediately, with no restart. It is checked entirely offline — no activation server, nothing phones home.
• If a licence expires: once the licence's grace period ends, Athena stops new actions (deployments, commands, remote control, new agent enrollment) but keeps your data visible: agents keep checking in, and sign-in, inventory and reports keep working. Separately licensed modules (BitLocker, Sysmon, Power Management) switch off entirely. A banner counts down beforehand.
• Terms: use of Athena is covered by our Terms of Service; third-party notices come with the first public release.

Details are in Licensing. For a full licence, email support@sealgrid.ai.

Network ports

Everything else is closed, including SSH. The appliance needs no outbound access; an optional HTTP(S) proxy can be set from the console menu.

Agents#

Agents are not a separate download — on purpose. Each Athena server runs its own certificate authority, so agents are installed from your Athena server, which hands out installers already carrying its address and CA:

1. In the Athena web console open Agents and click Install agent.
2. Pick Windows, Linux or macOS, then Copy one-liner. Your server address is already filled in.
3. Run it on the endpoint with admin / root rights and sign in with your Athena account when prompted. The agent installs, enrolls and receives its certificate automatically — no secrets are stored in the script.

For domain-wide rollout, token-based enrollment and offline installs, see Agent Enrollment and AD Agent Deployment.