Installing Enterprise

Installation live

Enterprise extends the Community core through the out-of-process plugin SDK — the boundary is architectural, not a feature switch, and the Community Edition is never crippleware. Enterprise adds:

• Browser Identity & Reputation and Endpoint Intelligence plugins, loaded by the engine as separate processes
• Central Manager — policy curation and an Ed25519-signed rule feed with a human approval queue
• Offline AI/ML — anomaly detection, attack clustering, endpoint-model training and an LLM analyst feeding the Learning tab (offline only, never in the real-time decision path)

Enterprise images live in a private registry prefix and require credentials issued with your commercial agreement — contact Tenforward AB to get a registry account and API token.

1. Registry credentials

Your token is a registry API key tied to your account identity. Verify access, then create the pull secret the chart references:

podman login zot.solutrix.io -u you@example.com -p zak_...

kubectl -n heimdall create secret docker-registry heimdall-registry \
  --docker-server=zot.solutrix.io \
  --docker-username=you@example.com \
  --docker-password=zak_...

2. Enterprise values overlay

Install the Community chart as in the Community guide, then layer an Enterprise overlay on top:

imagePullSecrets: ["heimdall-registry"]

images:
  registry: zot.solutrix.io/heimdall-shield-enterprise
  tag: v0.1.8                 # pin the Enterprise release you were issued

edge:
  plugins: ["/browser-plugin", "/endpoint-plugin"]
  ingest:
    enabled: true             # telemetry -> the ClickHouse data lake
    clickhouseURL: "http://hs-heimdall-shield-clickhouse:8123"
  endpointModel:
    enabled: true             # in-Pod trainer sidecar; engine hot-reloads the model
    image: heimdall-ml

clickhouse:
  enabled: true               # the data lake the offline ML analyzes

centralManager:
  enabled: true               # signed rule feed + curation console

feedPoll:
  enabled: true               # edge sidecar: verify feed -> Learning approval queue
  keyringSecret: heimdall-keyring

controlPlane:
  learning:
    enabled: true             # learning-export sidecar feeds the Learning tab
    image: heimdall-ml
    envFromSecret: heimdall-mistral   # optional LLM credentials for the briefing

helm upgrade hs deploy/helm/heimdall-shield -n heimdall \
  -f deploy/helm/heimdall-shield/examples/values-ce.yaml \
  -f your-site-values.yaml \
  -f your-enterprise-values.yaml

3. Verify

kubectl -n heimdall get pods            # edge Pod grows to 7/7 with all sidecars

In the GUI you should now see endpoint deviations and browser-identity findings in the Explorer, and the Learning tab filling with anomalies, clusters, rule suggestions and the analyst briefing. Suggestions only ever apply after a human approves them — the AI never decides in real time.