كل ما يلزم لنشر BALLA وتشغيله

# Install the SISKO agent
curl -fsSL https://get.sisko.ml/install.sh | sh

# Enroll the endpoint, then start
sisko-agent enroll --tenant <TENANT_ID> --token <ENROLL_TOKEN>
sisko-agent start

# /etc/sisko/agent.yaml
publisher:
  mode: kafka
  broker: kafka.internal:9092
  tls:
    enabled: true
collectors:
  processes: true
  network: true
  files: true
  auth: true
  hardware: true
buffer:
  max_events: 100000
  encrypt: true        # AES-256-GCM offline buffer

# List fleet machines (Ed25519 JWT)
curl https://api.sisko.ml/fleet \
  -H "Authorization: Bearer $SISKO_TOKEN"

{
  "machines": [
    {
      "equipment_id": "a3f1c9…",
      "hostname": "HR-WKS-008",
      "status": "online",
      "severity": "critical",
      "last_seen": "2026-08-12T09:41:00Z"
    }
  ],
  "total": 128
}

// Real-time alerts over WebSocket
const ws = new WebSocket("wss://api.sisko.ml/alerts/ws?token=" + token);
ws.onmessage = (e) => console.log(JSON.parse(e.data));

# docker-compose.yml (excerpt)
services:
  balla:
    image: sisko/balla:latest
  api:
    image: sisko/api:latest
    ports: ["8000:8000"]
  dashboard:
    image: sisko/dashboard:latest
    ports: ["3000:3000"]

// Every command sent to an endpoint is signed
{
  "action": "isolate_machine",
  "equipment_id": "a3f1c9…",
  "signature": "ed25519:…",
  "rollback_token": "b7c2…"
}