Getting started

Build

Delta needs a C compiler, CMake (>= 3.16), Ninja and git (the build fetches the JSMN JSON parser). From the repository root:

make build

The binary is installed to build/fs/bin/delta. See Building for the full build matrix, and Build- & run-time features for size / feature options.

A first check

Run a one-shot check of the live host. Without a config every collected domain is reported and the exit code reflects pass/fail:

./build/fs/bin/delta --processes --ports
./build/fs/bin/delta --processes --ports --json    # structured output

Delta exits 0 when all checks pass and 1 otherwise, so it drops straight into CI.

Capture a baseline, then detect drift

The natural workflow is to snapshot a known-good system as a “golden” norm and then check against it later (see Baseline capture):

# on a known-good system / freshly built image
delta --baseline golden.json

# later, anywhere — any deviation is a violation
delta --processes --ports --packages --netif --cfg golden.json --json

Common next steps

• Watch a live device — Continuous monitoring (--interval).

• Scan a firmware image offline — Offline image analysis (--root).

• Find vulnerable packages — Packages & vulnerabilities (--cve-feed).

• Spot the odd device in a fleet — Fleet / cohort analysis (--fleet).

• Ship reports to a collector — Shipping reports to a server (--server).

The complete option list is in CLI reference; the config schema in Configuration.