Skip to content
Warden docs

Install Warden

Warden installs with veltro, the installer all Veltrosecurity products share. Ask it for Warden and you get Warden on its own: the sign-in page, page titles and navigation are Warden’s.

Warden is maintenance-only for this milestone. Existing cases, approvals, integrations and approval-expiry and response-reversal workers stay supported. New SOAR features and vendor integrations aren’t release prerequisites for VectorFlow or Sigmatic. See the operating rules.

Before you start

Section titled “Before you start”

You need a Linux host with:

  • Docker Engine and Docker Compose 2.20 or later
  • Python 3.10 or later for the installer
  • a DNS name pointing at the host, if you want a public certificate

veltro doctor warns below 4 vCPU or 16 GB of memory and fails below 20 GB of free disk. No smaller size has been measured for Warden on its own. Requirements has the details.

Install

Section titled “Install”

Use the one-line installer with --products warden, or install from a clone:

Terminal window
git clone https://github.com/veltrosecurity/veltro && cd veltro
pip install ./cli
veltro install --products warden --source . \
  --public-url https://warden.example.com

--products warden makes this a Warden install. --public-url is the https address people use. The gateway serves plain HTTP, so put your reverse proxy in front of the gateway as TLS and your reverse proxy shows. With no proxy of your own, the installer can run Caddy with a certificate you supply (--tls custom) or one from its own CA for a LAN (--tls internal). If your proxy runs on this host, follow that page before you install: the gateway takes port 80 by default.

You end up with a gateway on one address, the sign-in service, PostgreSQL and Redis, and Warden at /warden/ with its worker.

Sign in and give yourself access

Section titled “Sign in and give yourself access”

Open your public URL and sign in. With Warden as the only product, the sign-in page carries Warden’s name and / opens Home, which lists what needs you.

Your first admin already has the admin role in Warden. Other administrators don’t, so grant a role to everyone who needs Warden in Settings > Users. What each role may do is set in Warden’s own settings. Sign-in and access covers SSO and tokens.

Take alerts in

Section titled “Take alerts in”

Warden on its own takes alerts from any detection tool through generic webhook sources. Create a source in Warden, map the fields of the tool’s payload onto a case, and point the tool at the source’s URL with its token.

Keep it running

Section titled “Keep it running”
Terminal window
veltro status                 # containers and health checks
veltro doctor                 # host checks, with the command that fixes each failure
veltro backup --to ./warden-backup.tar
veltro upgrade --to <release> # takes a backup first; --dry-run prints the plan

Backup and upgrade has the details. To run Warden on Kubernetes, install the veltro chart with only Warden enabled; see Kubernetes.

If you later add Sigmatic, its alerts open Warden cases directly. Install two or more products explains what changes.