Aikido Security

https://help.aikido.dev/
Admin
Aikido Security is an all-in-one, developer-friendly security platform that helps organizations scan...
Tokens:457,562
Snippets:4,486
Trust Score:10
Update:1 week ago
Show doc for...
Tokens:
Raw
### Install EndpointProtection-amd64.deb on Ubuntu/Debian

Source: https://help.aikido.dev/aikido-device-protection/deploying-aikido-endpoint/linux/install-device-protection-for-linux

Download the .deb package for amd64 architecture and install it with apt, passing the AIKIDO_TOKEN environment variable. The package reads the token during installation and starts the service automatically.

```bash
curl -fLO https://github.com/AikidoSec/safechain-internals/releases/latest/download/EndpointProtection-amd64.deb
sudo AIKIDO_TOKEN=<your-token> apt install ./EndpointProtection-amd64.deb
```

--------------------------------

### Run Aikido setup skill

Source: https://help.aikido.dev/ai-and-dev-tools/aikido-mcp/anthropic-claude-code-mcp

Run this command in Claude Code CLI to start the Aikido setup skill. It opens a browser window for logging in to Aikido, stores the token securely in Claude Code settings, and registers the MCP server automatically.

```bash
/aikido:setup
```

--------------------------------

### Configure GitHub-hosted runner for Device Protection

Source: https://help.aikido.dev/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/device-protection-in-github-actions

Example workflow configuration for a GitHub-hosted runner using the container install flavor. It includes starting the agent, checking out code, and sourcing the Aikido profile before installing dependencies.

```yaml
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Start Device Protection
        env:
          AIKIDO_TOKEN: ${{ secrets.AIKIDO_TOKEN }}
        run: |
          curl -fsSL https://github.com/AikidoSec/safe-chain/raw/refs/heads/main/install-scripts/install-endpoint-linux.sh \
            | sudo AIKIDO_TOKEN="$AIKIDO_TOKEN" sh -s -- --container
          sudo aikido-endpoint-protection-start --wait-for-healthy

      - uses: actions/checkout@v4

      - name: Install dependencies
        run: |
          for f in /etc/profile.d/aikido-*.sh; do . "$f"; done
          npm ci
```

--------------------------------

### Example app initialization with Zen

Source: https://help.aikido.dev/zen-firewall/zen-installation-instructions/zen-firewall-for-python/fastapi

Shows how to initialize Zen protection before creating the FastAPI app.

```python
import aikido_zen
aikido_zen.protect()

from fastapi import FastAPI
app = FastAPI()
```

--------------------------------

### Install Device Protection in a Buildkite job (pipeline.yml)

Source: https://help.aikido.dev/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/device-protection-in-buildkite

Use this pipeline step to install and start Device Protection before installing dependencies on ephemeral agents. Export AIKIDO_TOKEN before install, use AIKIDO_CONTAINER=1 and AIKIDO_CI_CD=1, then start the agent and source profile scripts. The install requires root; prefix with sudo if running as buildkite-agent user.

```yaml
agents:
  queue: linux-small

steps:
  - label: ":shield: install dependencies"
    command: |
      export AIKIDO_TOKEN=$$(buildkite-agent secret get AIKIDO_TOKEN)

      curl -fsSLO https://github.com/AikidoSec/safechain-internals/releases/latest/download/EndpointProtection-amd64.deb
      AIKIDO_CONTAINER=1 AIKIDO_CI_CD=1 apt-get install -y --no-install-recommends ./EndpointProtection-amd64.deb

      aikido-endpoint-protection-start --wait-for-healthy
      for f in /etc/profile.d/aikido-*.sh; do . "$$f"; done

      npm ci

```

--------------------------------

### Example resource configuration

Source: https://help.aikido.dev/miscellaneous-integrations/aikido-terraform-provider

Example showing configuration for repository settings, AutoFix dependency settings, and PR check settings.

```hcl
resource "aikido_repository" "app" {
  id     = "12345"
  active = true

  sensitivity  = "sensitive"
  connectivity = "connected"

  labels = ["payments", "production"]
}

resource "aikido_autofix_dependency_settings" "workspace" {
  enabled                      = true
  severity_filter              = "critical_and_high_only"
  repos_scope                  = "all"
  use_aikido_library_for_major = true
}

resource "aikido_repo_pr_checks_settings" "app" {
  code_repo_id = 12345

  minimum_severity                  = "high"
  fail_on_dependency_scan            = true
  fail_on_sast_scan                  = true
  fail_on_iac_scan                   = true
  fail_on_secrets_scan               = true
  fail_on_malware_scan               = true
  post_inline_comments_min_severity  = "critical"

  minimum_license_severity = "high"

  fail_on_code_quality_scan                      = true
  enable_code_quality_scan                       = true
  post_code_quality_inline_comments_min_severity = "medium"
}
```

--------------------------------

### Source Device Protection in Bitbucket Pipelines step (bitbucket-pipelines.yml)

Source: https://help.aikido.dev/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/device-protection-in-bitbucket-pipelines

Example bitbucket-pipelines.yml that sources the start script at the beginning of a step before installing dependencies. Each step runs in a new container, so the script must be sourced in every step. Use '.' to source, not 'sh'.

```yaml
image: node:20-bookworm

pipelines:
  default:
    - step:
        name: Install dependencies
        script:
          - . ci/start-device-protection.sh
          - npm ci
```

--------------------------------

### Build with zen-go

Source: https://help.aikido.dev/zen-firewall/zen-installation-instructions/zen-firewall-for-golang/echo

Build your binary with zen-go so Zen can instrument your binary.

```bash
go tool zen-go go build -o bin/app
```

--------------------------------

### Install and start Device Protection script (ci/start-device-protection.sh)

Source: https://help.aikido.dev/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/device-protection-in-bitbucket-pipelines

Use this script in Bitbucket Pipelines to install the container flavor of Device Protection and start the agent. It downloads and runs the install script, waits for the agent to be healthy, then sources the profile scripts. Requires curl and root privileges.

```bash
curl -fsSL https://github.com/AikidoSec/safe-chain/raw/refs/heads/main/install-scripts/install-endpoint-linux.sh | sh -s -- --container
aikido-endpoint-protection-start --wait-for-healthy
for f in /etc/profile.d/aikido-*.sh; do . "$f"; done
```

--------------------------------

### Build and run container with install script method

Source: https://help.aikido.dev/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/device-protection-in-containers

Builds the image with the required AIKIDO_TOKEN build arg and runs it with --init. The token must be passed at build time; the build cannot see the shell environment.

```bash
docker build -t my-app --build-arg AIKIDO_TOKEN=<your-token> .
docker run --rm --init my-app
```

--------------------------------

### Install EndpointProtection-amd64.el9.rpm on RHEL/Rocky/CentOS

Source: https://help.aikido.dev/aikido-device-protection/deploying-aikido-endpoint/linux/install-device-protection-for-linux

Download the .rpm package for amd64 architecture and install it with dnf, passing the AIKIDO_TOKEN environment variable. The package reads the token during installation and starts the service automatically.

```bash
curl -fLO https://github.com/AikidoSec/safechain-internals/releases/latest/download/EndpointProtection-amd64.el9.rpm
sudo AIKIDO_TOKEN=<your-token> dnf install ./EndpointProtection-amd64.el9.rpm
```

--------------------------------

### Full .aikido Configuration Example

Source: https://help.aikido.dev/autofix-and-remediation/configure/autofix-pr-configuration

A comprehensive example showing various configuration options for AutoFix, including PR prefixes, labels, automation policies, and base branch settings.

```yaml
autofix:
  pr_config:
    branch_prefix: "aikido-"
    title_prefix: "Aikido "
    commit_prefix: "[fix] "
    labels: "security"
    draft_pr: true
    auto_merge: true
    create_task_for_pr: true
    task_title_prefix: "[AIK] "
    disable_codeowners_as_reviewers: true
    self_approve_pr: true
  automated:
    disabled: false
    dependency:
      update_policy: minor_and_patch_versions_only
      single_pr_for_repo: false
      lockfile_groups:
        - group_name: service1
          lockfiles:
            - 'service1/*'
  base_branch: develop
```

--------------------------------

### Initialize Zen and update dependencies

Source: https://help.aikido.dev/zen-firewall/zen-installation-instructions/zen-firewall-for-golang/echo

Run these commands in your application module (the one containing main) to initialize Zen and update dependencies.

```bash
go run github.com/AikidoSec/firewall-go/cmd/zen-go@latest init
go mod tidy
```

--------------------------------

### User-data with reboot after install

Source: https://help.aikido.dev/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/deploy-device-protection-with-cloud-init

Add a power_state block to reboot the machine after the install completes. This ensures services that started earlier in the boot pick up the Aikido CA environment variables set by the install.

```yaml
#cloud-config
runcmd:
  - curl -fsSLo /tmp/aikido.deb https://github.com/AikidoSec/safechain-internals/releases/latest/download/EndpointProtection-amd64.deb
  - AIKIDO_TOKEN=<your-token> apt-get install -y /tmp/aikido.deb
  - rm -f /tmp/aikido.deb

power_state:
  mode: reboot
  message: Rebooting to activate Aikido Device Protection
  condition: true

```

--------------------------------

### Create the installation script for the Dev Container Feature

Source: https://help.aikido.dev/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/device-protection-in-dev-containers

Create the install.sh script to handle the installation of the Aikido Device Protection package based on the system architecture and package manager (apt or dnf).

```bash
#!/usr/bin/env bash
set -euo pipefail

case "$(uname -m)" in
  x86_64) ARCH=amd64 ;;
  aarch64) ARCH=arm64 ;;
  *) echo "Aikido Device Protection: unsupported architecture $(uname -m)" >&2; exit 1 ;;
esac

if command -v apt-get >/dev/null 2>&1; then
  apt-get update
  apt-get install -y --no-install-recommends curl ca-certificates
  curl -fLO "https://github.com/AikidoSec/safechain-internals/releases/latest/download/EndpointProtection-${ARCH}.deb"
  AIKIDO_CONTAINER=1 AIKIDO_CI_CD=1 apt-get install -y --no-install-recommends "./EndpointProtection-${ARCH}.deb"
  rm -f "EndpointProtection-${ARCH}.deb"
  rm -rf /var/lib/apt/lists/*
elif command -v dnf >/dev/null 2>&1; then
  . /etc/os-release
  EL="el${VERSION_ID%%.*}"
  dnf install -y --setopt=install_weak_deps=False curl ca-certificates
  curl -fLO "https://github.com/AikidoSec/safechain-internals/releases/latest/download/EndpointProtection-${ARCH}.${EL}.rpm"
  AIKIDO_CONTAINER=1 AIKIDO_CI_CD=1 dnf install -y --setopt=install_weak_deps=False "./EndpointProtection-${ARCH}.${EL}.rpm"
  rm -f "EndpointProtection-${ARCH}.${EL}.rpm"
else
  echo "Aikido Device Protection: no apt-get or dnf found, unsupported base image" >&2
  exit 1
fi
```

--------------------------------

### Verify installation status

Source: https://help.aikido.dev/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/deploy-device-protection-with-terraform

Run these commands on a new instance to confirm that cloud-init has finished, the service is active, and the aikidoctl tool is installed.

```bash
cloud-init status --wait
systemctl is-active aikido-endpoint-protection
aikidoctl version
```

--------------------------------

### Install agent in Docker plugin step

Source: https://help.aikido.dev/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/device-protection-in-buildkite

Use this pipeline step to install dependencies in a container while starting the Aikido agent. The plugin preserves the image's ENTRYPOINT, so the agent starts automatically. If you override the entrypoint or command, run `aikido-endpoint-protection-start --wait-for-healthy` first.

```yaml
steps:
  - label: ":shield: install dependencies"
    command: |
      for f in /etc/profile.d/aikido-*.sh; do . "$$f"; done
      npm ci
    plugins:
      - docker#v5.14.0:
          image: "ghcr.io/your-org/my-app:latest"
          environment:
            - AIKIDO_TOKEN
```

--------------------------------

### Verify installation with systemctl and aikidoctl

Source: https://help.aikido.dev/aikido-device-protection/deploying-aikido-endpoint/linux/install-device-protection-for-linux

Run these commands to check the service status and the aikidoctl version after installation. The device should appear in the device list with an Active status.

```bash
systemctl status aikido-endpoint-protection
aikidoctl version
```

--------------------------------

### Start Gunicorn in dry mode

Source: https://help.aikido.dev/zen-firewall/zen-installation-instructions/zen-firewall-for-python/gunicorn

Example command to start Gunicorn with blocking disabled and token set. Use AIKIDO_DEBUG=true for more detailed agent information.

```bash
AIKIDO_BLOCK=false AIKIDO_TOKEN=YOUR_SECRET_TOKEN gunicorn -c gunicorn_config.py --workers 2 app:app
```

--------------------------------

### Install Device Protection on Microsoft-hosted agent (azure-pipelines.yml)

Source: https://help.aikido.dev/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/device-protection-in-azure-pipelines

YAML pipeline steps for Microsoft-hosted agents: installs the container flavor of Device Protection, starts the agent, and installs dependencies. Requires AIKIDO_TOKEN secret mapped under env, token passed after sudo, and sourcing /etc/profile.d/aikido-*.sh in every step that installs packages.

```yaml
pool:
  vmImage: ubuntu-latest

steps:
  - script: |
      curl -fsSL https://github.com/AikidoSec/safe-chain/raw/refs/heads/main/install-scripts/install-endpoint-linux.sh \
        | sudo AIKIDO_TOKEN="$AIKIDO_TOKEN" sh -s -- --container
      sudo aikido-endpoint-protection-start --wait-for-healthy
    displayName: Start Device Protection
    env:
      AIKIDO_TOKEN: $(AIKIDO_TOKEN)

  - script: |
      for f in /etc/profile.d/aikido-*.sh; do . "$f"; done
      npm ci
    displayName: Install dependencies
```
Tokens:
Raw