Vigil Baseline

Spec sheet

Purpose

Vigil Baseline is a file integrity monitor for one desktop Linux workstation that watches selected files and reports changes.Read 7 Oct 2026 · github.com

Integrations

The README identifies a signal socket and webhook as the only integration points, both disabled by default and outbound-only when enabled.Read 7 Oct 2026 · github.com

License

The source code is offered under GNU GPL v3.0 only or a commercial license.Read 7 Oct 2026 · github.com

Maker

The repository identifies Louis Nelson Jr. as the copyright holder and describes lousclues as the project maker.Read 7 Oct 2026 · github.com

Audit trail

Changes are recorded in a crash-safe write-ahead log and an HMAC-chained audit log.Read 7 Oct 2026 · github.com

Baseline

It records file hashes, permissions, ownership, inode, capabilities, extended attributes, and SELinux or AppArmor context in a known-good snapshot.Read 7 Oct 2026 · github.com

Daemon security

The systemd unit is described as hardened with MemoryMax, PrivateTmp, NoNewPrivileges, and minimal capabilities.Read 7 Oct 2026 · vigilbaseline.com

Deployment limits

The project says it is for one Linux desktop and does not provide fleet management or central reporting.Read 7 Oct 2026 · github.com

File watching

It watches filesystem events through fanotify, with an inotify fallback, and compares events against the baseline.Read 7 Oct 2026 · github.com

Integrity records

It uses BLAKE3 hashing and an HMAC-chained audit log.Read 7 Oct 2026 · vigilbaseline.com

Kernel coverage

On FID-capable Linux 5.1+ kernels it supports real-time coverage across event classes; on older kernels scheduled scans detect some event types.Read 7 Oct 2026 · github.com

Limitations

Vigil is not an EDR and does not kill, quarantine, or block processes or files.Read 7 Oct 2026 · vigilbaseline.com

Maker profile

The maker's site says Lou makes small software and lists Vigil as an active Linux file integrity monitor.Read 7 Oct 2026 · lousclues.com

Monitoring

It uses kernel fanotify with an inotify fallback to watch filesystem changes.Read 7 Oct 2026 · vigilbaseline.com

Network and telemetry

The README says Vigil has no telemetry and makes no network calls by default.Read 7 Oct 2026 · github.com

No automatic response

Vigil does not kill processes, quarantine files, or block execution, and the README says it is not an EDR.Read 7 Oct 2026 · github.com

Notable limits

It is not designed for servers, headless hosts, containers, Kubernetes, fleets, multi-tenant systems, central reporting, or remote control.Read 7 Oct 2026 · github.com

Notifications

Notifications are storm-suppressed and sent to the desktop session using notify-send when available.Read 7 Oct 2026 · github.com

Package installation

The installable package is named vigil-baseline and is installed with apt or dnf after repository setup.Read 7 Oct 2026 · vigilbaseline.com

Package signing

Packages and repository metadata are signed, and updates arrive through the package manager.Read 7 Oct 2026 · vigilbaseline.com

Publisher

The repository identifies Vigil Baseline as a lousclues project and names Louis Nelson Jr. in its copyright notice.Read 7 Oct 2026 · github.com

Setup

The interactive vigil welcome configuration takes about ninety seconds and can be safely rerun.Read 7 Oct 2026 · vigilbaseline.com

Supported audience

The project is intended for one human operator on a Linux desktop or laptop, including Arch, Debian, Ubuntu, Fedora, or a similar desktop distribution.Read 7 Oct 2026 · github.com

Supported use

The maker describes Vigil as a file integrity monitor for a Linux desktop, including desktop distributions such as Arch, Debian, Ubuntu, and Fedora.Read 7 Oct 2026 · github.com

Plans and prices

Every Vigil Baseline plan and price →

Where Specifiction places it

• File Integrity Monitoring Software#18 of 347.8