Get TMAegis for Windows, macOS or Linux. Every file comes straight from GitHub Releases, with its SHA-256 next to it so you can check it.
apply with --dry-run before changing production systems.We look at your browser to pick the right file. Nothing is sent anywhere; the detection runs on your device.
Detecting your system…
Not right? Choose your system
Choose your system below.
All systemsPick your system for the files, the commands and the warnings to expect.
tmaegis_0.1.0_windows_amd64.zip
9235c243b1376cccbc221b31615f140e16a41846c568b508b84907e3c6eec244Copy-ready command
Expand-Archive .\tmaegis_0.1.0_windows_amd64.zip -DestinationPath tmaegis
cd tmaegis
.\tmaegis.exe scan --auto-detect
.\tmaegis.exe apply --auto-detect --dry-runtmaegis_0.1.0_windows_arm64.zip
620c5f0703d454aeed1001a9106c11c76b1ca718460aeb6730f6b9445ff4403aCopy-ready command
Expand-Archive .\tmaegis_0.1.0_windows_arm64.zip -DestinationPath tmaegis
cd tmaegis
.\tmaegis.exe scan --auto-detect
.\tmaegis.exe apply --auto-detect --dry-runThe commands use the file name shown above. Use the name of the file you downloaded if it differs.
SmartScreen
tmaegis_0.1.0_darwin_arm64.tar.gz
98a71fbb5c05ef83ea4df1e899c3124f2c986e30b9e7ce9d3bbde0957fd3430bCopy-ready command
mkdir tmaegis && tar -xzf tmaegis_0.1.0_darwin_arm64.tar.gz -C tmaegis && cd tmaegis
xattr -d com.apple.quarantine ./tmaegis
./tmaegis scan --auto-detect
sudo ./tmaegis apply --auto-detect --dry-runtmaegis_0.1.0_darwin_amd64.tar.gz
fc2c406df01b56adc953a02e3a70f34ca85dc6734cb0b3309504b74220e1e75aCopy-ready command
mkdir tmaegis && tar -xzf tmaegis_0.1.0_darwin_amd64.tar.gz -C tmaegis && cd tmaegis
xattr -d com.apple.quarantine ./tmaegis
./tmaegis scan --auto-detect
sudo ./tmaegis apply --auto-detect --dry-runThe commands use the file name shown above. Use the name of the file you downloaded if it differs.
Gatekeeper
tmaegis_0.1.0_linux_amd64.tar.gz
7c6e5f75aafdf2b88c8ce40dc537ce49af8b83856a0c371b01e4506dcbf77fe2Copy-ready command
mkdir tmaegis && tar -xzf tmaegis_0.1.0_linux_amd64.tar.gz -C tmaegis && cd tmaegis
sudo ./tmaegis scan --auto-detect
sudo ./tmaegis apply --auto-detect --dry-runThe commands use the file name shown above. Use the name of the file you downloaded if it differs.
Builds for FreeBSD, IBM AIX, Oracle Solaris and Linux on IBM Z (s390x) and RISC-V. They use the same rules and commands as the other systems.
Experimental builds
tmaegis_0.1.0_freebsd_amd64.tar.gz
7c55a0e83aae2f7e4763c675ca12f5e972056bb7f1868b2e529e95c277dccda2Copy-ready command
mkdir tmaegis && tar -xzf tmaegis_0.1.0_freebsd_amd64.tar.gz -C tmaegis && cd tmaegis
# as root (su, doas or sudo):
./tmaegis scan --auto-detect
./tmaegis apply --auto-detect --dry-runtmaegis_0.1.0_freebsd_arm64.tar.gz
c254e110f8ac0d94795a034baa57ec06d96125d6f73e4edaf857e525d52bcff3Copy-ready command
mkdir tmaegis && tar -xzf tmaegis_0.1.0_freebsd_arm64.tar.gz -C tmaegis && cd tmaegis
# as root (su, doas or sudo):
./tmaegis scan --auto-detect
./tmaegis apply --auto-detect --dry-runtmaegis_0.1.0_aix_ppc64.tar.gz
18e119d088d1a96ea3041eec1f3aa76ce884e31a37aaa0fd3b53d8dc7e69d133Copy-ready command
mkdir tmaegis && cd tmaegis
gzip -dc ../tmaegis_0.1.0_aix_ppc64.tar.gz | tar -xf -
# as root:
./tmaegis scan --auto-detect
./tmaegis apply --auto-detect --dry-runtmaegis_0.1.0_solaris_amd64.tar.gz
6c6ae3a300ed2c28c11e7ec402a1cfa39995a93cbd7437476c5cc83258972e10Copy-ready command
mkdir tmaegis && cd tmaegis
gzip -dc ../tmaegis_0.1.0_solaris_amd64.tar.gz | tar -xf -
# as root:
./tmaegis scan --auto-detect
./tmaegis apply --auto-detect --dry-runtmaegis_0.1.0_linux_s390x.tar.gz
00e3ec11d0ffca8688b0b404fa49e6996d7a2d2e4da818af3c08dc018fd6dad8Copy-ready command
mkdir tmaegis && tar -xzf tmaegis_0.1.0_linux_s390x.tar.gz -C tmaegis && cd tmaegis
sudo ./tmaegis scan --auto-detect
sudo ./tmaegis apply --auto-detect --dry-runtmaegis_0.1.0_linux_riscv64.tar.gz
a6a5b5adff71686f1f8bbbcb818a0e25c1e7283be2ef34934c6343f078e858a9Copy-ready command
mkdir tmaegis && tar -xzf tmaegis_0.1.0_linux_riscv64.tar.gz -C tmaegis && cd tmaegis
sudo ./tmaegis scan --auto-detect
sudo ./tmaegis apply --auto-detect --dry-runThe commands use the file name shown above. Use the name of the file you downloaded if it differs.
ghcr.io/tmaegis/tmaegis:0.1.0Copy-ready command
docker pull ghcr.io/tmaegis/tmaegis:0.1.0
docker run --rm ghcr.io/tmaegis/tmaegis:0.1.0 --helpThe rules are inside the image and the entrypoint is tmaegis, so everything after the image name goes straight to the tmaegis command.
Mount the folder that holds the exported file read-only and point --device-config at it. The container never connects to the device.
docker run --rm -v "$PWD:/data:ro" ghcr.io/tmaegis/tmaegis:0.1.0 \
scan --target cisco-ios --device-config /data/running-config.txtAudit the device configurations kept in your repository on every change, and keep the SARIF report as a build artifact.
docker run --rm -v "$PWD:/data:ro" ghcr.io/tmaegis/tmaegis:0.1.0 \
scan --target juniper-junos --device-config /data/configs/router.txt --format sarif > tmaegis.sarifScanning the host from a container is not supported
You need Git, Go 1.27 or newer and make.
git clone https://github.com/tmaegis/tmaegis.git
cd tmaegis
make build
./bin/tmaegis scan --auto-detectmake build-all cross-compiles for Linux, Windows and macOS.
The same single file scans, reports and fixes on every system. Nothing is installed on the machines you check, and every fix can be undone.
One download
tmaegis · tmaegis.exe
A single static binary with the rules next to it. The same commands on Windows, macOS, Linux and the Unix systems.
01Scan
Detects what is installed and runs only the checks that apply. Read-only: nothing changes.
02Report
Findings ranked by severity, as HTML, PDF, Excel, SARIF or JSON.
03Fix
Preview with --dry-run, then apply. A snapshot is taken first and every change is verified.
Dead-man's switch
After a fix, TMAegis waits for you to confirm that the system still works (60 seconds by default).
Find the system you want to check. Each card says where to run TMAegis, what to export or sign in to first, and the exact scan command.
One tool for every platform
The same tmaegis download covers all 96 platforms. It runs on Windows, macOS or Linux; what changes is where you run it and what it reads.
Network devices: an exported file
TMAegis never connects to a router, switch or firewall. You export the configuration as text, copy the file to your computer and scan it there.
Remote scans over SSH: planned
Scanning or hardening other machines over SSH or WinRM is not available yet. It is planned, with no date. Today, run TMAegis on each machine, or scan exported files.
Some systems have nothing to install
Phones, Intune profiles, printers, mainframes and some SaaS tenants cannot run TMAegis. For those it prints a checklist to work through by hand.
96 systems shown
cassandra · 21 rules: 14 automated, 7 manual
Where to run it: On the database server, as root or Administrator, with the database's own client on the PATH and an administrative database login.
Scan command
tmaegis scan --target cassandraapache · 86 rules: 60 automated, 26 manual
Where to run it: On the server that runs it, as root (sudo).
Scan command
tmaegis scan --target apachetomcat · 61 rules: 56 automated, 5 manual
Where to run it: On the server that runs it, as root (sudo).
export CATALINA_BASE=/opt/tomcat # your Tomcat folder (default /opt/tomcat)Scan command
tmaegis scan --target tomcatsafari · 11 rules: 11 automated, 0 manual
Where to run it: On the Mac, in Terminal. Use sudo for the full scan.
Scan command
tmaegis scan --target safariazure-container-linux · 116 rules: 110 automated, 6 manual
Where to run it: On the host, from a root shell (admin or toolbox container).
These systems have a read-only root file system: copy the Linux archive to a writable folder and run it from there.
Commands and menus differ between versions: check your version's documentation.
Scan command
tmaegis scan --target azure-container-linuxbind · 51 rules: 41 automated, 10 manual
Where to run it: On the server that runs it, as root (sudo).
Scan command
tmaegis scan --target bindbottlerocket · 30 rules: 26 automated, 4 manual
Where to run it: On the host, from a root shell (admin or toolbox container).
These systems have a read-only root file system: copy the Linux archive to a writable folder and run it from there.
Commands and menus differ between versions: check your version's documentation.
Scan command
tmaegis scan --target bottlerocketcockroachdb · 31 rules: 10 automated, 21 manual
Where to run it: On the database server, as root or Administrator, with the database's own client on the PATH and an administrative database login.
export COCKROACH_CERTS_DIR=/var/lib/cockroach/certsScan command
tmaegis scan --target cockroachdbcos · 119 rules: 72 automated, 47 manual
Where to run it: On the host, from a root shell (admin or toolbox container).
These systems have a read-only root file system: copy the Linux archive to a writable folder and run it from there.
Commands and menus differ between versions: check your version's documentation.
Scan command
tmaegis scan --target cosdocker · 119 rules: 88 automated, 31 manual
Where to run it: On the Docker host, as root or a member of the docker group.
Scan command
tmaegis scan --target dockerfreebsd · 148 rules: 135 automated, 13 manual
Where to run it: On the AIX, Solaris or FreeBSD system, as root.
An experimental build for this system is in each release: compile-checked only, not yet run on real hardware. Try it on a test system first; if a release lacks it, build it from source with Go. Experimental downloads
Scan command
tmaegis scan --target freebsdchrome · 118 rules: 105 automated, 13 manual
Where to run it: On each Windows PC the policy applies to, in PowerShell as Administrator. The checks read the policy settings that are in effect.
Scan command
tmaegis scan --target chromeaix · 232 rules: 221 automated, 11 manual
Where to run it: On the AIX, Solaris or FreeBSD system, as root.
An experimental build for this system is in each release: compile-checked only, not yet run on real hardware. Try it on a test system first; if a release lacks it, build it from source with Go. Experimental downloads
Scan command
tmaegis scan --target aixdb2 · 215 rules: 133 automated, 82 manual
Where to run it: On the database server, as root or Administrator, with the database's own client on the PATH and an administrative database login.
Scan command
tmaegis scan --target db2websphere · 113 rules: 79 automated, 34 manual
Where to run it: On the server that runs it, as root (sudo).
export WLP_USER_DIR=/opt/ibm/wlp/usr # your Liberty user directoryScan command
tmaegis scan --target websphereintune-defender · 55 rules: 55 automated, 0 manual
Where to run it: On each Windows PC the policy applies to, in PowerShell as Administrator. The checks read the policy settings that are in effect.
The checks read the Intune policy that has reached the PC. Run the scan on a managed PC, not in the Intune admin center.
Scan command
tmaegis scan --target intune-defenderintune-office · 238 rules: 237 automated, 1 manual
Where to run it: On each Windows PC the policy applies to, in PowerShell as Administrator. The checks read the policy settings that are in effect.
The checks read the Intune policy that has reached the PC. Run the scan on a managed PC, not in the Intune admin center.
Scan command
tmaegis scan --target intune-officekerberos · 9 rules: 9 automated, 0 manual
Where to run it: On the server that runs it, as root (sudo).
Scan command
tmaegis scan --target kerberoslinux · 5,730 rules: 5,730 automated, 0 manual
Where to run it: On the Linux machine, as root (sudo).
Scan command
tmaegis scan --target linuxlxd · 6 rules: 5 automated, 1 manual
Where to run it: On the Linux machine, as root (sudo).
Scan command
tmaegis scan --target lxdmacos · 366 rules: 264 automated, 102 manual
Where to run it: On the Mac, in Terminal. Use sudo for the full scan.
Scan command
tmaegis scan --target macosmariadb · 75 rules: 45 automated, 30 manual
Where to run it: On the database server, as root or Administrator, with the database's own client on the PATH and an administrative database login.
The checks use the mysql client with its defaults: put an administrative account in the [client] section of ~/.my.cnf of the user running the scan.
Scan command
tmaegis scan --target mariadbmcp-server · 55 rules: 24 automated, 31 manual
Where to run it: On the server that runs it, as root (sudo).
export MCP_CONFIG=/etc/mcp/server.json # the server's configuration fileScan command
tmaegis scan --target mcp-serverdefender · 59 rules: 59 automated, 0 manual
Where to run it: On each Windows PC the policy applies to, in PowerShell as Administrator. The checks read the policy settings that are in effect.
Scan command
tmaegis scan --target defenderedge · 148 rules: 148 automated, 0 manual
Where to run it: On each Windows PC the policy applies to, in PowerShell as Administrator. The checks read the policy settings that are in effect.
Scan command
tmaegis scan --target edgeexchange · 61 rules: 58 automated, 3 manual
Where to run it: On the Windows server that runs it, in PowerShell as Administrator.
Scan command
tmaegis scan --target exchangeiis · 55 rules: 50 automated, 5 manual
Where to run it: On the Windows server that runs it, in PowerShell as Administrator.
Scan command
tmaegis scan --target iisoffice · 241 rules: 241 automated, 0 manual
Where to run it: On each Windows PC the policy applies to, in PowerShell as Administrator. The checks read the policy settings that are in effect.
Scan command
tmaegis scan --target officesharepoint · 42 rules: 13 automated, 29 manual
Where to run it: On the Windows server that runs it, in PowerShell as Administrator.
Scan command
tmaegis scan --target sharepointmssql · 97 rules: 74 automated, 23 manual
Where to run it: On the database server, as root or Administrator, with the database's own client on the PATH and an administrative database login.
Scan command
tmaegis scan --target mssqlmongodb · 27 rules: 20 automated, 7 manual
Where to run it: On the database server, as root or Administrator, with the database's own client on the PATH and an administrative database login.
Scan command
tmaegis scan --target mongodbfirefox · 57 rules: 57 automated, 0 manual
Where to run it: On each Windows PC the policy applies to, in PowerShell as Administrator. The checks read the policy settings that are in effect.
Scan command
tmaegis scan --target firefoxmysql · 79 rules: 47 automated, 32 manual
Where to run it: On the database server, as root or Administrator, with the database's own client on the PATH and an administrative database login.
The checks use the mysql client with its defaults: put an administrative account in the [client] section of ~/.my.cnf of the user running the scan.
Scan command
tmaegis scan --target mysqlnginx · 46 rules: 34 automated, 12 manual
Where to run it: On the server that runs it, as root (sudo).
Scan command
tmaegis scan --target nginxoceanbase · 42 rules: 23 automated, 19 manual
Where to run it: On the database server, as root or Administrator, with the database's own client on the PATH and an administrative database login.
export OB_CONN="-h127.0.0.1 -P2881 -uroot@sys -p<password>"Scan command
tmaegis scan --target oceanbaseoracle-db · 98 rules: 85 automated, 13 manual
Where to run it: On the database server, as root or Administrator, with the database's own client on the PATH and an administrative database login.
export ORACLE_HOME=<oracle-home>
export ORACLE_SID=<sid>Scan command
tmaegis scan --target oracle-dbsolaris · 92 rules: 83 automated, 9 manual
Where to run it: On the AIX, Solaris or FreeBSD system, as root.
An experimental build for this system is in each release: compile-checked only, not yet run on real hardware. Try it on a test system first; if a release lacks it, build it from source with Go. Experimental downloads
Scan command
tmaegis scan --target solarispostgres · 74 rules: 37 automated, 37 manual
Where to run it: On the database server, as root or Administrator, with the database's own client on the PATH and an administrative database login.
export PGUSER=postgres PGDATABASE=postgres # the defaultsScan command
tmaegis scan --target postgresredis · 8 rules: 8 automated, 0 manual
Where to run it: On the database server, as root or Administrator, with the database's own client on the PATH and an administrative database login.
Scan command
tmaegis scan --target redisros · 228 rules: 203 automated, 25 manual
Where to run it: On the Linux machine, as root (sudo).
Scan command
tmaegis scan --target rossupply-chain · 124 rules: 12 automated, 112 manual
Where to run it: In a checkout of the repository, or as a step in your CI pipeline.
cd <your-repository>
gh auth login # only for the checks that read GitHub settingsScan command
tmaegis scan --target supply-chaintdsql · 106 rules: 55 automated, 51 manual
Where to run it: On the database server, as root or Administrator, with the database's own client on the PATH and an administrative database login.
export TDSQL_HOME=/data/tdsql # the defaultScan command
tmaegis scan --target tdsqlvscode · 6 rules: 5 automated, 1 manual
Where to run it: On each Windows PC the policy applies to, in PowerShell as Administrator. The checks read the policy settings that are in effect.
Scan command
tmaegis scan --target vscodevmware · 268 rules: 186 automated, 82 manual
Where to run it: Where esxcli can query the ESXi host.
The checks call esxcli. Where esxcli is not available, list the checks with --include-manual and review them by hand.
Commands and menus differ between versions: check your version's documentation.
Scan command
tmaegis scan --target vmwarewindows · 2,626 rules: 2,626 automated, 0 manual
Where to run it: On the Windows PC or server, in PowerShell as Administrator.
Scan command
tmaegis scan --target windowsyugabytedb · 54 rules: 31 automated, 23 manual
Where to run it: On the database server, as root or Administrator, with the database's own client on the PATH and an administrative database login.
export PGHOST=127.0.0.1 PGPORT=5433 PGUSER=yugabyte # the defaultsScan command
tmaegis scan --target yugabytedbzoom · 177 rules: 2 automated, 175 manual
Where to run it: On each Windows PC the policy applies to, in PowerShell as Administrator. The checks read the policy settings that are in effect.
Scan command
tmaegis scan --target zoomarista-eos · 33 rules: 29 automated, 4 manual
Where to run it: On any computer. Copy the exported file there; TMAegis does not connect to the device.
terminal length 0
show running-configSave the complete output as a text file (for example with your terminal's session log), copy it to the computer that runs TMAegis and put its path after --device-config.
Scan command
tmaegis scan --target arista-eos --device-config <file>Every archive and the repository contain a compliant and a non-compliant example configuration. Run this in the folder you extracted:
./tmaegis scan --target arista-eos --device-config samples/network/arista-eos/arista-eos-noncompliant.txtOn Windows:
.\tmaegis.exe scan --target arista-eos --device-config samples\network\arista-eos\arista-eos-noncompliant.txtcheckpoint · 62 rules: 35 automated, 27 manual
Where to run it: On any computer. Copy the exported file there; TMAegis does not connect to the device.
# in clish, on each gateway and management server
set clienv rows 0
show configurationSave the complete output as a text file (for example with your terminal's session log), copy it to the computer that runs TMAegis and put its path after --device-config.
Scan command
tmaegis scan --target checkpoint --device-config <file>Every archive and the repository contain a compliant and a non-compliant example configuration. Run this in the folder you extracted:
./tmaegis scan --target checkpoint --device-config samples/network/checkpoint/checkpoint-noncompliant.txtOn Windows:
.\tmaegis.exe scan --target checkpoint --device-config samples\network\checkpoint\checkpoint-noncompliant.txtcisco-asa · 81 rules: 74 automated, 7 manual
Where to run it: On any computer. Copy the exported file there; TMAegis does not connect to the device.
terminal pager 0
show running-configSave the complete output as a text file (for example with your terminal's session log), copy it to the computer that runs TMAegis and put its path after --device-config.
Scan command
tmaegis scan --target cisco-asa --device-config <file>Every archive and the repository contain a compliant and a non-compliant example configuration. Run this in the folder you extracted:
./tmaegis scan --target cisco-asa --device-config samples/network/cisco-asa/cisco-asa-noncompliant.txtOn Windows:
.\tmaegis.exe scan --target cisco-asa --device-config samples\network\cisco-asa\cisco-asa-noncompliant.txtcisco-ios · 87 rules: 64 automated, 23 manual
Where to run it: On any computer. Copy the exported file there; TMAegis does not connect to the device.
terminal length 0
show running-configSave the complete output as a text file (for example with your terminal's session log), copy it to the computer that runs TMAegis and put its path after --device-config.
Scan command
tmaegis scan --target cisco-ios --device-config <file>Every archive and the repository contain a compliant and a non-compliant example configuration. Run this in the folder you extracted:
./tmaegis scan --target cisco-ios --device-config samples/network/cisco-ios/cisco-ios-noncompliant.txtOn Windows:
.\tmaegis.exe scan --target cisco-ios --device-config samples\network\cisco-ios\cisco-ios-noncompliant.txtcisco-iosxr · 53 rules: 47 automated, 6 manual
Where to run it: On any computer. Copy the exported file there; TMAegis does not connect to the device.
terminal length 0
show running-configSave the complete output as a text file (for example with your terminal's session log), copy it to the computer that runs TMAegis and put its path after --device-config.
Scan command
tmaegis scan --target cisco-iosxr --device-config <file>Every archive and the repository contain a compliant and a non-compliant example configuration. Run this in the folder you extracted:
./tmaegis scan --target cisco-iosxr --device-config samples/network/cisco-iosxr/cisco-iosxr-noncompliant.txtOn Windows:
.\tmaegis.exe scan --target cisco-iosxr --device-config samples\network\cisco-iosxr\cisco-iosxr-noncompliant.txtcisco-nxos · 65 rules: 38 automated, 27 manual
Where to run it: On any computer. Copy the exported file there; TMAegis does not connect to the device.
terminal length 0
show running-configSave the complete output as a text file (for example with your terminal's session log), copy it to the computer that runs TMAegis and put its path after --device-config.
Scan command
tmaegis scan --target cisco-nxos --device-config <file>Every archive and the repository contain a compliant and a non-compliant example configuration. Run this in the folder you extracted:
./tmaegis scan --target cisco-nxos --device-config samples/network/cisco-nxos/cisco-nxos-noncompliant.txtOn Windows:
.\tmaegis.exe scan --target cisco-nxos --device-config samples\network\cisco-nxos\cisco-nxos-noncompliant.txtcisco-ftd · 48 rules: 4 automated, 44 manual
Where to run it: On any computer. Copy the exported file there; TMAegis does not connect to the device.
Most Cisco Secure Firewall settings are managed in the Management Center (FMC); those checks are on the checklist.
show running-config # on the FTD CLI (the > prompt)Save the complete output as a text file (for example with your terminal's session log), copy it to the computer that runs TMAegis and put its path after --device-config.
Scan command
tmaegis scan --target cisco-ftd --device-config <file>Every archive and the repository contain a compliant and a non-compliant example configuration. Run this in the folder you extracted:
./tmaegis scan --target cisco-ftd --device-config samples/network/cisco-ftd/cisco-ftd-noncompliant.txtOn Windows:
.\tmaegis.exe scan --target cisco-ftd --device-config samples\network\cisco-ftd\cisco-ftd-noncompliant.txtextreme-slx · 19 rules: 15 automated, 4 manual
Where to run it: On any computer. Copy the exported file there; TMAegis does not connect to the device.
terminal length 0
show running-configSave the complete output as a text file (for example with your terminal's session log), copy it to the computer that runs TMAegis and put its path after --device-config.
Scan command
tmaegis scan --target extreme-slx --device-config <file>Every archive and the repository contain a compliant and a non-compliant example configuration. Run this in the folder you extracted:
./tmaegis scan --target extreme-slx --device-config samples/network/extreme-slx/extreme-slx-noncompliant.txtOn Windows:
.\tmaegis.exe scan --target extreme-slx --device-config samples\network\extreme-slx\extreme-slx-noncompliant.txtf5-bigip · 30 rules: 24 automated, 6 manual
Where to run it: On any computer. Copy the exported file there; TMAegis does not connect to the device.
# in the BIG-IP advanced shell (bash)
for c in "auth password-policy" "auth source" "auth remote-user" "auth radius" "sys httpd" "sys sshd" "sys global-settings" "cli global-settings" "sys snmp" "net self"; do tmsh list $c all-properties; done > f5-bigip.txt
tmsh list sys ntp >> f5-bigip.txt
tmsh list sys syslog >> f5-bigip.txtSave the complete output as a text file (for example with your terminal's session log), copy it to the computer that runs TMAegis and put its path after --device-config.
Scan command
tmaegis scan --target f5-bigip --device-config <file>Every archive and the repository contain a compliant and a non-compliant example configuration. Run this in the folder you extracted:
./tmaegis scan --target f5-bigip --device-config samples/network/f5-bigip/f5-bigip-noncompliant.txtOn Windows:
.\tmaegis.exe scan --target f5-bigip --device-config samples\network\f5-bigip\f5-bigip-noncompliant.txtfortigate · 67 rules: 54 automated, 13 manual
Where to run it: On any computer. Copy the exported file there; TMAegis does not connect to the device.
config global # only on units with VDOMs enabled
show full-configurationSave the complete output as a text file (for example with your terminal's session log), copy it to the computer that runs TMAegis and put its path after --device-config.
Scan command
tmaegis scan --target fortigate --device-config <file>Every archive and the repository contain a compliant and a non-compliant example configuration. Run this in the folder you extracted:
./tmaegis scan --target fortigate --device-config samples/network/fortigate/fortigate-noncompliant.txtOn Windows:
.\tmaegis.exe scan --target fortigate --device-config samples\network\fortigate\fortigate-noncompliant.txtfortiswitch · 40 rules: 35 automated, 5 manual
Where to run it: On any computer. Copy the exported file there; TMAegis does not connect to the device.
show full-configurationSave the complete output as a text file (for example with your terminal's session log), copy it to the computer that runs TMAegis and put its path after --device-config.
Scan command
tmaegis scan --target fortiswitch --device-config <file>Every archive and the repository contain a compliant and a non-compliant example configuration. Run this in the folder you extracted:
./tmaegis scan --target fortiswitch --device-config samples/network/fortiswitch/fortiswitch-noncompliant.txtOn Windows:
.\tmaegis.exe scan --target fortiswitch --device-config samples\network\fortiswitch\fortiswitch-noncompliant.txtaruba-cx · 80 rules: 33 automated, 47 manual
Where to run it: On any computer. Copy the exported file there; TMAegis does not connect to the device.
show running-configSave the complete output as a text file (for example with your terminal's session log), copy it to the computer that runs TMAegis and put its path after --device-config.
Scan command
tmaegis scan --target aruba-cx --device-config <file>Every archive and the repository contain a compliant and a non-compliant example configuration. Run this in the folder you extracted:
./tmaegis scan --target aruba-cx --device-config samples/network/aruba-cx/aruba-cx-noncompliant.txtOn Windows:
.\tmaegis.exe scan --target aruba-cx --device-config samples\network\aruba-cx\aruba-cx-noncompliant.txtjuniper-junos · 181 rules: 149 automated, 32 manual
Where to run it: On any computer. Copy the exported file there; TMAegis does not connect to the device.
show configuration | display set | no-moreSave the complete output as a text file (for example with your terminal's session log), copy it to the computer that runs TMAegis and put its path after --device-config.
Scan command
tmaegis scan --target juniper-junos --device-config <file>Every archive and the repository contain a compliant and a non-compliant example configuration. Run this in the folder you extracted:
./tmaegis scan --target juniper-junos --device-config samples/network/juniper-junos/juniper-junos-noncompliant.txtOn Windows:
.\tmaegis.exe scan --target juniper-junos --device-config samples\network\juniper-junos\juniper-junos-noncompliant.txtopnsense · 29 rules: 15 automated, 14 manual
Where to run it: On any computer. Copy the exported file there; TMAegis does not connect to the device.
In the web interface: System > Configuration > Backups > Download configuration
# or, from the OPNsense shell:
cat /conf/config.xmlSave the complete output as a text file (for example with your terminal's session log), copy it to the computer that runs TMAegis and put its path after --device-config.
Scan command
tmaegis scan --target opnsense --device-config <file>Every archive and the repository contain a compliant and a non-compliant example configuration. Run this in the folder you extracted:
./tmaegis scan --target opnsense --device-config samples/network/opnsense/opnsense-noncompliant.txtOn Windows:
.\tmaegis.exe scan --target opnsense --device-config samples\network\opnsense\opnsense-noncompliant.txtpaloalto · 81 rules: 52 automated, 29 manual
Where to run it: On any computer. Copy the exported file there; TMAegis does not connect to the device.
set cli pager off
set cli config-output-format set
configure
showSave the complete output as a text file (for example with your terminal's session log), copy it to the computer that runs TMAegis and put its path after --device-config.
Scan command
tmaegis scan --target paloalto --device-config <file>Every archive and the repository contain a compliant and a non-compliant example configuration. Run this in the folder you extracted:
./tmaegis scan --target paloalto --device-config samples/network/paloalto/paloalto-noncompliant.txtOn Windows:
.\tmaegis.exe scan --target paloalto --device-config samples\network\paloalto\paloalto-noncompliant.txtpfsense · 37 rules: 21 automated, 16 manual
Where to run it: On any computer. Copy the exported file there; TMAegis does not connect to the device.
In the web interface: Diagnostics > Backup & Restore > Download configuration as XML
# or, from the pfSense shell:
cat /cf/conf/config.xmlSave the complete output as a text file (for example with your terminal's session log), copy it to the computer that runs TMAegis and put its path after --device-config.
Scan command
tmaegis scan --target pfsense --device-config <file>Every archive and the repository contain a compliant and a non-compliant example configuration. Run this in the folder you extracted:
./tmaegis scan --target pfsense --device-config samples/network/pfsense/pfsense-noncompliant.txtOn Windows:
.\tmaegis.exe scan --target pfsense --device-config samples\network\pfsense\pfsense-noncompliant.txtflasharray · 36 rules: 12 automated, 24 manual
Where to run it: On any computer that can reach the array's management address over SSH, to export the settings; then scan the file.
The checks read the Purity//FA CLI output in name=value form (--nvp). One file may hold the output of all the commands.
for c in "purearray list --ntp" "purepolicy password list" "purelog syslog list" "puresnmp list" "puresmtp list" "pureds list" "purealert watcher list"; do ssh pureuser@<array> "$c --nvp"; done > flasharray.txtSave the complete output as a text file (for example with your terminal's session log), copy it to the computer that runs TMAegis and put its path after --device-config.
Commands and menus differ between versions: check your version's documentation.
Scan command
tmaegis scan --target flasharray --device-config <file>sophos · 40 rules: 0 automated, 40 manual
Where to run it: On any computer. Copy the exported file there; TMAegis does not connect to the device.
Sophos Firewall has no plain-text configuration export, so most checks are reviewed in the web admin console.
In the web interface: Backup & firmware > Import export > Export full configuration
Save the complete output as a text file (for example with your terminal's session log), copy it to the computer that runs TMAegis and put its path after --device-config.
Commands and menus differ between versions: check your version's documentation.
Scan command
tmaegis scan --target sophos --include-manualThe current rules for this system are checklist items, so the sample file only shows what an export looks like.
View the sample files on GitHubalibaba · 86 rules: 34 automated, 52 manual
Where to run it: On any computer with the provider's command-line tool installed and signed in.
Use a read-only role (for example a security-audit or reader role). TMAegis only reads; fixes are proposed and never applied to your account.
aliyun configureScan command
tmaegis scan --target alibabaaws · 366 rules: 26 automated, 340 manual
Where to run it: On any computer with the provider's command-line tool installed and signed in.
Use a read-only role (for example a security-audit or reader role). TMAegis only reads; fixes are proposed and never applied to your account.
aws sso login --profile <profile> # or aws configure
export AWS_PROFILE=<profile>
aws sts get-caller-identityScan command
tmaegis scan --target awsgithub · 120 rules: 31 automated, 89 manual
Where to run it: On any computer with the provider's command-line tool installed and signed in.
Use a read-only role (for example a security-audit or reader role). TMAegis only reads; fixes are proposed and never applied to your account.
gh auth login
export GH_ORG=<organization>Scan command
tmaegis scan --target githubgitlab · 122 rules: 31 automated, 91 manual
Where to run it: On any computer with the provider's command-line tool installed and signed in.
Use a read-only role (for example a security-audit or reader role). TMAegis only reads; fixes are proposed and never applied to your account.
glab auth loginScan command
tmaegis scan --target gitlabgcp · 110 rules: 17 automated, 93 manual
Where to run it: On any computer with the provider's command-line tool installed and signed in.
Use a read-only role (for example a security-audit or reader role). TMAegis only reads; fixes are proposed and never applied to your account.
gcloud auth login
gcloud config set project <project-id>Scan command
tmaegis scan --target gcpgoogle-workspace · 97 rules: 3 automated, 94 manual
Where to run it: On any computer. Most checks are for the admin console.
The automated checks read your domain's DNS records (SPF, DKIM, DMARC); the rest is a checklist for the Admin console.
export DOMAIN=example.com # your primary Google Workspace domainScan command
tmaegis scan --target google-workspaceibmcloud · 81 rules: 8 automated, 73 manual
Where to run it: On any computer with the provider's command-line tool installed and signed in.
Use a read-only role (for example a security-audit or reader role). TMAegis only reads; fixes are proposed and never applied to your account.
ibmcloud login --sso
ibmcloud plugin install vpc-infrastructure
ibmcloud target -r <region>Scan command
tmaegis scan --target ibmcloudm365 · 176 rules: 16 automated, 160 manual
Where to run it: On a computer with PowerShell and the admin modules installed, signed in with a read-only admin role.
Sign in with an account that has a read-only admin role, such as Global Reader.
Connect-MgGraph -Scopes Policy.Read.All,Directory.Read.All
Connect-ExchangeOnlineCommands and menus differ between versions: check your version's documentation.
Scan command
tmaegis scan --target m365azure · 359 rules: 19 automated, 340 manual
Where to run it: On any computer with the provider's command-line tool installed and signed in.
Use a read-only role (for example a security-audit or reader role). TMAegis only reads; fixes are proposed and never applied to your account.
az login
az account set --subscription <subscription-id>Scan command
tmaegis scan --target azurepower-platform · 22 rules: 5 automated, 17 manual
Where to run it: On a computer with PowerShell and the admin modules installed, signed in with a read-only admin role.
Use a read-only role (for example a security-audit or reader role). TMAegis only reads; fixes are proposed and never applied to your account.
Install-Module Microsoft.PowerApps.Administration.PowerShell -Scope CurrentUser
Add-PowerAppsAccount
$env:PP_TENANT_ID = "<tenant-id>"Commands and menus differ between versions: check your version's documentation.
Scan command
tmaegis scan --target power-platformoci · 55 rules: 46 automated, 9 manual
Where to run it: On any computer with the provider's command-line tool installed and signed in.
Use a read-only role (for example a security-audit or reader role). TMAegis only reads; fixes are proposed and never applied to your account.
oci setup config # or: oci session authenticateScan command
tmaegis scan --target ociaks-automatic · 33 rules: 12 automated, 21 manual
Where to run it: On any computer where kubectl reaches the cluster.
az login
az aks get-credentials --resource-group <resource-group> --name <cluster>
export AKS_RG=<resource-group> AKS_NAME=<cluster>Scan command
tmaegis scan --target aks-automaticeks · 47 rules: 28 automated, 19 manual
Where to run it: On any computer where kubectl reaches the cluster.
aws sso login --profile <profile>
aws eks update-kubeconfig --region <region> --name <cluster> --profile <profile>
export AWS_PROFILE=<profile> EKS_CLUSTER=<cluster>Scan command
tmaegis scan --target ekseks-auto · 34 rules: 15 automated, 19 manual
Where to run it: On any computer where kubectl reaches the cluster.
aws sso login --profile <profile>
aws eks update-kubeconfig --region <region> --name <cluster> --profile <profile>
export AWS_PROFILE=<profile> EKS_CLUSTER=<cluster>Scan command
tmaegis scan --target eks-autoaks · 50 rules: 24 automated, 26 manual
Where to run it: On any computer where kubectl reaches the cluster.
az login
az aks get-credentials --resource-group <resource-group> --name <cluster>
export AKS_RG=<resource-group> AKS_NAME=<cluster>Scan command
tmaegis scan --target aksgke-autopilot · 29 rules: 13 automated, 16 manual
Where to run it: On any computer where kubectl reaches the cluster.
gcloud auth login
gcloud container clusters get-credentials <cluster> --location <location> --project <project-id>
export GKE_CLUSTER=<cluster> GKE_LOCATION=<location> GKE_PROJECT=<project-id>Scan command
tmaegis scan --target gke-autopilotgke · 54 rules: 33 automated, 21 manual
Where to run it: On any computer where kubectl reaches the cluster.
gcloud auth login
gcloud container clusters get-credentials <cluster> --location <location> --project <project-id>
export GKE_CLUSTER=<cluster> GKE_LOCATION=<location> GKE_PROJECT=<project-id>Scan command
tmaegis scan --target gkekubernetes · 134 rules: 74 automated, 60 manual
Where to run it: On any computer where kubectl reaches the cluster.
kubectl config use-context <context>
kubectl auth can-i --list # check that the role is read-onlyScan command
tmaegis scan --target kubernetesopenshift-virt · 26 rules: 9 automated, 17 manual
Where to run it: On any computer where kubectl reaches the cluster.
oc login --server=https://api.<cluster-domain>:6443
oc whoamiScan command
tmaegis scan --target openshift-virtoke · 43 rules: 20 automated, 23 manual
Where to run it: On any computer where kubectl reaches the cluster.
oci ce cluster create-kubeconfig --cluster-id <cluster-ocid> --file $HOME/.kube/config --region <region> --token-version 2.0.0
export OKE_CLUSTER_ID=<cluster-ocid>Scan command
tmaegis scan --target okeopenshift · 115 rules: 13 automated, 102 manual
Where to run it: On any computer where kubectl reaches the cluster.
oc login --server=https://api.<cluster-domain>:6443
oc whoamiScan command
tmaegis scan --target openshiftios · 106 rules: 0 automated, 106 manual
Where to run it: Nothing can be installed on the phone or tablet.
No agent can be installed on this system. The command prints the checklist; review each item in the vendor's console or on the device.
Scan command
tmaegis scan --target ios --include-manualdb2-zos · 78 rules: 0 automated, 78 manual
Where to run it: Nothing runs on the mainframe or IBM i system itself.
No agent can be installed on this system. The command prints the checklist; review each item in the vendor's console or on the device.
Scan command
tmaegis scan --target db2-zos --include-manualandroid · 47 rules: 1 automated, 46 manual
Where to run it: Nothing can be installed on the phone or tablet.
No agent can be installed on this system. The command prints the checklist; review each item in the vendor's console or on the device.
Scan command
tmaegis scan --target android --include-manualcics · 8 rules: 0 automated, 8 manual
Where to run it: Nothing runs on the mainframe or IBM i system itself.
No agent can be installed on this system. The command prints the checklist; review each item in the vendor's console or on the device.
Scan command
tmaegis scan --target cics --include-manualibm-i · 117 rules: 0 automated, 117 manual
Where to run it: Nothing runs on the mainframe or IBM i system itself.
No agent can be installed on this system. The command prints the checklist; review each item in the vendor's console or on the device.
Scan command
tmaegis scan --target ibm-i --include-manualibm-z · 235 rules: 0 automated, 235 manual
Where to run it: Nothing runs on the mainframe or IBM i system itself.
No agent can be installed on this system. The command prints the checklist; review each item in the vendor's console or on the device.
Scan command
tmaegis scan --target ibm-z --include-manualintune-ios · 94 rules: 0 automated, 94 manual
Where to run it: Nothing to install: these are settings in the Intune admin center.
No agent can be installed on this system. The command prints the checklist; review each item in the vendor's console or on the device.
Scan command
tmaegis scan --target intune-ios --include-manualintune-macos · 100 rules: 0 automated, 100 manual
Where to run it: Nothing to install: these are settings in the Intune admin center.
No agent can be installed on this system. The command prints the checklist; review each item in the vendor's console or on the device.
Scan command
tmaegis scan --target intune-macos --include-manualprinter · 50 rules: 0 automated, 50 manual
Where to run it: Nothing can be installed on a printer: the checks are for its web interface.
No agent can be installed on this system. The command prints the checklist; review each item in the vendor's console or on the device.
Scan command
tmaegis scan --target printer --include-manualoracle-saas · 44 rules: 0 automated, 44 manual
Where to run it: On any computer. Most checks are for the admin console.
No agent can be installed on this system. The command prints the checklist; review each item in the vendor's console or on the device.
Scan command
tmaegis scan --target oracle-saas --include-manualEverything ships in the same archive. Use the parts you need.
The tmaegis binary scans, fixes and rolls back. tmaegis gui opens the same engine in a window that listens only on your own machine and works offline.
tmaegis scan --auto-detect
tmaegis guiOn Windows, double-click Start-TMAegis-GUI.cmd in the extracted folder to open the GUI.
tmaegis-server collects the reports of many hosts in one place. Start it with Docker Compose from the source repository; scans send their report with --push-url.
export TMAEGIS_SERVER_TOKEN=$(openssl rand -hex 24)
docker compose up -d
tmaegis scan --auto-detect --push-url http://localhost:8080The tmaegis-server binary is also inside each release archive. Set TMAEGIS_SERVER_TOKEN before you start it.
HTML, XLSX and PDF reports are built in, next to SARIF, JSON and more: nine formats from one scan, with nothing extra to install.
tmaegis scan --auto-detect --format html --output report.html
tmaegis scan --auto-detect --format xlsx --output report.xlsx
tmaegis scan --auto-detect --format pdf --output report.pdfEvery archive contains the YAML rules in the rules folder. They are plain files you can read, compare and extend; point the scanner at another folder with --rules-dir.
tmaegis rules export -o rules.json
tmaegis scan --rules-dir ./rules --target linux16,927 rules for 96 platforms, from operating systems and databases to network devices and cloud. Browse them all on the Platforms page.
Check every download against its SHA-256 before you run it. The hash is shown on each file card and listed in checksums.txt.
Get-FileHash .\tmaegis_0.1.0_windows_amd64.zip -Algorithm SHA256
Select-String -Path .\checksums.txt -Pattern tmaegis_0.1.0_windows_amd64.zipshasum -a 256 tmaegis_0.1.0_darwin_arm64.tar.gz
grep tmaegis_0.1.0_darwin_arm64.tar.gz checksums.txtsha256sum -c checksums.txt --ignore-missing
sha256sum tmaegis_0.1.0_linux_amd64.tar.gz# FreeBSD
sha256 tmaegis_0.1.0_freebsd_amd64.tar.gz
# Solaris
digest -a sha256 tmaegis_0.1.0_solaris_amd64.tar.gz
# AIX (or any system with OpenSSL)
openssl dgst -sha256 tmaegis_0.1.0_aix_ppc64.tar.gz
grep <file name> checksums.txtDownload only from www.tmaegis.dev or from github.com/tmaegis/tmaegis/releases. This website does not host the files; every Download button goes to GitHub Releases.
If the SHA-256 of your file differs from the one shown here and in checksums.txt, delete the file and do not run it.
The binaries are not code-signed. Windows SmartScreen and macOS Gatekeeper may warn about them. That is expected, and the SHA-256 check is how you confirm the file is genuine.
Report vulnerabilities privately, not in a public issue. The security policy explains how.
TMAegis is a single static binary. There is nothing to install on the machines you scan.
| System | Processor | Needs |
|---|---|---|
| Windows | x64 (Intel, AMD) and ARM64 | Windows PowerShell 5.1 or newer for the rules that use PowerShell. Run as Administrator to apply fixes. |
| macOS | Apple silicon (ARM64) and Intel (x64) | A current macOS release. Use sudo to apply fixes. |
| Linux | x64 (amd64) and ARM64 (aarch64) | A 64-bit distribution; the binary is static and needs no libraries. Run as root: a scan without root reports the checks that need root as failed. |
| FreeBSD, AIX, Solaris (experimental) | FreeBSD x64 and ARM64, AIX POWER (ppc64), Solaris x64; Linux on s390x and riscv64 | Compile-checked only, never run on real hardware. Run as root and test on a non-production system first. |
Cloud, database and network-device checks run from any of these systems.
TMAegis is free and open source under the Mozilla Public License 2.0. You can use it at work and for your clients, and read, change and share the source code.
The names TMAegis and tmaegis and the TM Cyber-Shield logo are trademarks of the project founders and are not covered by the licence. The trademark policy explains what you may do without asking.