The flow
Define
You create a
tripwire in the UI - a token type, a source, and a path. The server stores
the definition and builds an install command for it.
Distribute
Your MDM/SSH runs that
install command on the machines you choose. Your tooling is the control
plane for which machines are in scope - Thumper doesn’t manage device groups.
Enroll & plant
On each machine the Bash
agent calls
POST /api/enroll with the shared enroll token, then
GET /api/agent/deployments to pull its own instances. It writes the bait
to disk and starts watching.Watch
The agent monitors the bait
paths for a read (via
fs_usage on macOS; see
Read detection).Trigger
On a read, the agent POSTs an
HMAC-signed, enriched callback to
POST /api/trigger. The server verifies the
signature, records an alert, and fans it out to every configured alert
integration.Why per-endpoint uniqueness matters
Deploying a tripwire mints a separate deployment for every endpoint, and each one carries its own bait content and its own HMAC secret. The secret is minted server-side and handed only to that endpoint’s agent - it is never returned by the UI API and never written into the planted file. That isolation buys two things:- No cross-box forgery. A secret leaked from one machine can’t be used to forge a trigger for another. Each deployment can only sign for itself.
- Attributable reads. Because the bait and secret are unique per box, a fired alert points to exactly one endpoint - there’s no ambiguity about which machine was touched.