Technical Details

System requirements, scanning capabilities, architecture, and license details.

Prerequisites

SEAMUS runs entirely in containers. You need a container runtime — that's it. No Python, Ruby, Go, or other language runtimes to install on the host.

Supported Platforms

Architecture

SEAMUS deploys as three containers managed by Docker Compose (or podman-compose):

All scan data, configuration, reports, and audit logs are stored in a data/ directory on the host, mounted as Docker volumes. Your data stays on your machine.

Scanning Capabilities

Automated Scans

AI Analysis

After each scan cycle, SEAMUS sends scan results to an AI model for analysis. The AI:

• Summarizes findings in plain English
• Flags anomalies (new hosts, unexpected ports, trend changes)
• Explains CVEs with remediation steps
• Assesses false positive likelihood
• Delivers weekly digests to your notification channels

Notifications

SEAMUS supports 7 notification channels, each with topic-tagged alerts:

Reports

Generated automatically after every scan cycle:

• HTML — interactive report for browser review
• PDF — executive-ready, printable
• Markdown — for git repositories and wikis
• CSV — for SIEM import, spreadsheets, and analysis

The seamus CLI

A single command-line interface manages the entire platform:

seamus setup          # Interactive first-run wizard
seamus up             # Start all containers
seamus down           # Stop all containers
seamus update         # Pull latest images and restart
seamus scan           # Run a scan now
seamus findings       # View latest findings
seamus report         # Generate reports
seamus validate       # Run tool validation tests (auditor-ready)
seamus audit          # View audit log
seamus audit --verify # Verify hash chain integrity
seamus audit export   # Export audit log for auditors
seamus proxy test     # Test proxy configuration
seamus license        # View license status
seamus uninstall      # Remove SEAMUS

Compliance & Audit

SEAMUS is designed to produce evidence that auditors accept:

• Hash-chained audit log — every scan execution is recorded in a SHA-256 hash-chained JSONL file. Breaking any entry invalidates all subsequent hashes. Verify integrity with seamus audit --verify.
• SOC 2 control mapping — maps SEAMUS capabilities to Trust Services Criteria (CC3.1, CC6.1, CC7.1–CC7.4)
• ISO 27001 control mapping — maps to Annex A controls (A.5.7, A.8.2.1, A.8.9, A.8.15, A.8.16, A.5.36)
• Tool validation reports — seamus validate produces signed, auditor-ready reports proving each scanning tool works in your environment
• Console Compliance tab — browse audit logs, control mappings, and validation reports in the web UI with filter, verify, export, and print

Windows 10/11 Setup Guide

SEAMUS runs on Windows via WSL2 (Windows Subsystem for Linux) and Docker Desktop. All SEAMUS commands run inside a WSL2 terminal, not in Windows CMD or PowerShell.

Prerequisites

1. Enable WSL2 — open PowerShell as Administrator:

   wsl --install

   Restart when prompted. This installs Ubuntu by default.
2. Install Docker Desktop — download from docker.com
   • During install, ensure "Use WSL2 based engine" is checked
   • In Docker Desktop settings → Resources → WSL Integration, enable your Ubuntu distro

Installation

1. Open a WSL2 terminal (search "Ubuntu" in Start Menu)
2. From this point, all commands are identical to Linux:

   # Copy the distribution zip into WSL (or download directly)
   cp /mnt/c/Users/YourName/Downloads/seamus-dist-1.0.3.zip ~
   cd ~
   unzip seamus-dist-1.0.3.zip
   cd seamus
   ./seamus setup
   ./seamus up

Accessing the Console

The Console and Uptime Kuma are accessible from your Windows browser at the same URLs shown by ./seamus up. Docker Desktop forwards the ports from WSL2 to Windows automatically.

Setting Up Automated Scanning

SEAMUS detects your platform and guides you to the right scheduling method:

# If cron is available (most WSL2 Ubuntu installs):
./seamus setup-cron

# If cron is not available, use Windows Task Scheduler:
./seamus setup-task

The setup-task command generates a PowerShell command you run in an Administrator PowerShell window. It creates two Windows Scheduled Tasks that call SEAMUS through WSL2 automatically.

To remove scheduled tasks:

./seamus remove-cron    # Linux cron
./seamus remove-task    # Windows Task Scheduler

Proxy Support

SEAMUS supports rotating proxy IPs for scanning, useful for avoiding rate limits or IP-based blocking. Configure a proxy provider (e.g., WebShare) in seamus.env and all scan tools route through it automatically. Test with seamus proxy test.

License & What Happens at Expiry

SEAMUS uses a signed license file (HMAC-SHA256). There is no DRM and no kill switch. The Console sends a lightweight, non-blocking telemetry beacon (version, license ID, timestamp) on startup for usage analytics — see the Privacy Policy for details. SEAMUS does not contact our servers to validate your license or restrict functionality.

2-week free trial

Full functionality, no credit card required. A trial license is created automatically on first run.

Active license

Everything works: Console, AI analysis, reports, notifications, compliance tooling, and all scans.

Expired or cancelled

When your license expires or you stop renewing:

Setting Up AI Features

SEAMUS AI features are optional and require an API key from Anthropic. All scanning, reporting, and notifications work without AI enabled.

Step 1: Create an Anthropic account

1. Go to console.anthropic.com
2. Sign up or log in
3. Navigate to Settings → API Keys
4. Click Create Key
5. Copy the key (it starts with sk-ant-)

Step 2: Add the key to SEAMUS

Either re-run the setup wizard:

./seamus setup

Or edit data/config/notify.conf directly:

ANTHROPIC_API_KEY="sk-ant-your-key-here"

No restart is needed. The Console reads the key on each chat request, and scan scripts pick it up on the next run.

Cost

AI features use Anthropic's API with prompt caching enabled (~90% cost reduction on repeat queries). Typical cost:

• Weekly digest: ~$0.05/week
• Daily scan analysis: ~$0.01/run
• Console chat: ~$0.01–0.05/query
• Total: ~$1–2/month for typical usage

What the AI can see

The AI receives your scan results, configuration, and documentation as context for each request. Data is sent to Anthropic's API for processing and is not stored by the AI provider beyond the duration of the request. No scan data is shared with other customers or used for training.

TLS Certificates

SEAMUS generates a self-signed TLS certificate on first startup. The Console serves over HTTPS automatically. Your browser will show a certificate warning — this is expected and the connection is still encrypted.

Using your own certificate

If your organization requires a trusted certificate (e.g., from Let's Encrypt or an internal CA), replace the self-signed files:

data/certs/console.pem       # Your certificate (PEM format)
data/certs/console-key.pem   # Your private key (PEM format)

Then restart the Console:

./seamus down && ./seamus up

The certificate files must be readable by the Console container. No other configuration is needed — the Console automatically uses whatever certificate is at that path.

Updating SEAMUS

To update SEAMUS to the latest version:

./seamus update

This pulls the latest container images and restarts services. Your data, configuration, and license are preserved — they live in data/ and are not part of the container images.

You can also update manually:

./seamus down
docker compose pull    # or: podman-compose pull
./seamus up

Exporting Data

All SEAMUS data lives in the data/ directory on your host. You own it and can export it at any time:

To export the audit log for auditors:

./seamus audit export

To back up everything:

tar czf seamus-backup-$(date +%Y%m%d).tar.gz data/