Evidence you can check.

THE TECHNICAL CHAPTER

How Keen Agent works.

One record per fact

Keen Agent turns each recognised event or measured setting into one evidence envelope in the Universal Evidence Utility (UEU) format. An envelope names its event type from an event catalogue (for example software.package.changed or endpoint.screen_lock.observed), the device and collector that produced it, the outcome, and typed facts: true or false, numbers and times where the catalogue says so. A setting a collector cannot measure is simply omitted, and each run also reports which checks it could not complete, so Keen can tell “not measured” from “failing”.

{
  "event_type": "endpoint.screen_lock.observed",
  "event_time": "2026-10-27T06:43:38.095Z",
  "source": { "application_id": "keen-posture", "component": "windows_user_policy" },
  "subject": { "identifier_type": "pairwise",
               "identifier": "hmac-sha256:d5d35e70…" },
  "observation": {
    "scope": "user",
    "facts": { "automatic_lock_configured": true,
               "lock_after_seconds": 900,
               "lock_paths": ["secure_screen_saver"] } },
  "privacy": { "personal_data_included": false,
               "transformations": ["subject-pseudonymised"] },
  "integrity": { "sequence": 42, "previous_evidence_hash": "sha256:abab…" }
}

Keys, signatures and the chain

When a device enrols, it creates its own Ed25519 key pair and proves to Keen that it holds the private key; Keen keeps only the public key, and the private key never leaves the device. The agent renews its key before it expires.

• Chained. Each envelope carries its sequence number and the SHA-256 hash of the one before, sealed in the same disk transaction that queues it. Keen shows whether every record follows on, and any queued evidence the agent had to discard is itself reported, so a gap always has an explanation.
• Signed in batches. Each delivery carries a signed manifest listing every envelope's hash. A batch that changed in transit is rejected whole.
• Signed requests. Every request is signed (HTTP Message Signatures, RFC 9421) over its encrypted body, bound to its endpoint, and accepted once within a five-minute window.
• Kept with its custody record. Keen stores the exact signed bytes whenever its own redaction leaves them untouched, and otherwise records each change and the reason beside the original hash. Each record's checks are shown on its event page in Keen.

Encrypted end to end, post-quantum

TLS only protects traffic as far as whatever holds a certificate for your Keen's address: a reverse proxy, a CDN or load balancer, an inspecting middlebox on a workstation's network, or an impostor that obtained a certificate. So Keen Agent encrypts everything it sends, enrolment code included, to your Keen itself.

• Pinned to your Keen. Keen holds its own identity key, and its fingerprint ends every enrolment code. Before sending anything, the agent checks that the server proves it holds that key, and refuses one that does not, valid certificate or not.
• Post-quantum encryption. Each request's key comes from two key exchanges at once: ML-KEM-768, the NIST post-quantum standard (FIPS 203), and the classical X25519. Reading it means breaking both, so traffic recorded today cannot be decrypted by a quantum computer built later. Bodies and responses use AES-256-GCM.
• Only Keen can answer. Each request carries a one-time key that only Keen can read, and Keen encrypts its reply with it. The agent removes evidence from its queue only on a reply that opens, so nothing in between can acknowledge your evidence away.
• Keys that expire. Keen replaces its encryption key every 30 days and erases old ones, so recorded traffic cannot later be opened with keys taken from Keen.

Signatures, for the device's key, Keen's identity and the evidence itself, use Ed25519. A future quantum computer could forge those, but a forgery only helps an attacker who is active at the time; recorded traffic cannot be impersonated after the fact, and passing off forged evidence as historical still needs write access to Keen. Since Go 1.24 the agent's TLS client also offers a hybrid post-quantum key exchange, a second layer wherever your reverse proxy supports it.

Choose what servers send

Each log source has an evidence mode, and Keen sets the most each server may send:

Filters drop noise on the server before anything is queued, by field, value or network, for example health checks from your load balancer.

Workstation posture

Keen shows each device against the person it belongs to and judges every check with versioned rules. Set your own targets, such as “screens lock within 15 minutes” or “antivirus signatures at most three days old”, as effectiveness measures, and Keen judges each device against your policy and records the measured value beside every result.

Privacy and security by design

• Pseudonyms at source. Usernames, user IDs and Windows SIDs become keyed pseudonyms on the device. Per-device (pairwise) pseudonyms keep the same person unlinkable across machines; shared (public) pseudonyms let Keen see one account across devices. You choose per agent.
• Only declared fields. Each event type lists the fields it may carry and the fields it must never carry; anything else is dropped on the device, and the envelope records the removal.
• Nothing listening. The agent has no inbound port, remote commands or plugins. It runs unprivileged under a hardened systemd unit, and the posture probes are fixed and read-only.
• Verified transport, and then some. TLS certificates and hostnames are always verified and redirects refused; inside TLS, every request is encrypted to your Keen's own pinned key.

The full specification of the evidence format and the protocol is in the agent's evidence format documentation, and Keen's administrator guide covers operation in detail.

INSTALL

Install Keen Agent 0.3.0.

Every package, installer and repository is signed with the mig5 release key. Check its fingerprint before trusting it:

RELEASE KEY FINGERPRINT54A9 1143 AE0A B4F7 743B 01FE 888E D1B4 23A3 BC99Download the public key

sudo mkdir -p /usr/share/keyrings
curl -fsSL https://mig5.net/static/mig5.asc | sudo gpg --dearmor -o /usr/share/keyrings/mig5.gpg
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/mig5.gpg] https://apt.mig5.net $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/mig5.list
sudo apt update
sudo apt install keen-agent

sudo rpm --import https://mig5.net/static/mig5.asc
sudo tee /etc/yum.repos.d/mig5.repo > /dev/null << 'EOF'
[mig5]
name=mig5 Repository
baseurl=https://rpm.mig5.net/$releasever/rpm/$basearch
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://mig5.net/static/mig5.asc
EOF
sudo dnf upgrade --refresh
sudo dnf install keen-agent

Windows and macOS

The newest release is always at /downloads/keen-agent/latest/, and every release stays at its own versioned address. Windows installers are also Authenticode-signed and the macOS package is Developer ID signed and notarised by Apple.

Verify your download

Import the release key once, check its fingerprint matches the one above, then check the signature of the checksums and the checksum of the installer.

curl -fsSL https://mig5.net/static/mig5.asc | gpg --import
gpg --fingerprint 54A91143AE0AB4F7743B01FE888ED1B423A3BC99
gpg --verify SHA256SUMS.asc SHA256SUMS
shasum -a 256 --check --ignore-missing SHA256SUMS
pkgutil --check-signature keen-posture-0.3.0-macos-universal.pkg

Invoke-WebRequest https://mig5.net/static/mig5.asc -OutFile mig5.asc
gpg --import mig5.asc
gpg --fingerprint 54A91143AE0AB4F7743B01FE888ED1B423A3BC99
gpg --verify SHA256SUMS.asc SHA256SUMS
Get-FileHash .\keen-posture-0.3.0-windows-amd64.msi -Algorithm SHA256
Get-AuthenticodeSignature .\keen-posture-0.3.0-windows-amd64.msi

Then enrol

sudoedit /etc/keen-agent/config.yaml        # endpoint and sources
sudo install -o root -g keen-agent -m 0640 /dev/null /etc/keen-agent/enrollment-code
sudoedit /etc/keen-agent/enrollment-code    # paste the code
sudo -u keen-agent keen-agent -command enroll
sudo rm /etc/keen-agent/enrollment-code
sudo systemctl enable --now keen-agent

Autoscaling fleets can enrol themselves with an enrollment profile instead. See the Keen Agent guide for configuration, evidence mapping and troubleshooting.