Requirements
What to have ready before installing 3AM. A Linux server or a Kubernetes cluster, somewhere for the models to run, and access to the tools it should watch.
You need three things: somewhere to run 3AM, somewhere for its models, and access to your tools. The installer checks the first two before it changes anything, and tells you what's missing.
A server or a cluster
One Linux server is the simplest way to run 3AM. We run it every day on this:
| Size | 8 vCPU, 32 GB memory, 100 GB SSD (GCP e2-standard-8, AWS m6i.2xlarge, Azure Standard_D8s_v5) |
| System | Any x86_64 Linux. We test on Ubuntu 24.04, Fedora and RHEL 8 and 9 |
| Containers | Podman 4+ or Docker 24+. If neither is installed, the installer offers to install Podman |
That size is generous. 3AM spends most of an investigation waiting on your systems and the models, so 8 vCPU handles around a thousand connected tools. The installer accepts as little as 2 vCPU, 4 GB and 20 GB of free disk for a trial. Sizing has the measurements.
A Kubernetes cluster works too: version 1.27 or later, with a default StorageClass. The installer fetches
kubectl and Helm if they're missing, and if you have no cluster it can set up k3s on the machine you're on.
OpenShift is supported. Kubernetes
Somewhere for the models
3AM's models run on a GPU or behind an endpoint. They never run on the CPU, where every investigation would wait on them. Pick one:
- Your own endpoint (recommended): an OpenAI-compatible server in your network, such as vLLM or a gateway. We test with Llama 3.3 70B Instruct.
- OpenRouter: hosted models, with just an API key.
- A GPU in the server: NVIDIA or AMD, with 8 GB of GPU memory or more.
With no GPU, the installer asks which endpoint to use. Models explains the trade-offs.
Network
3AM opens every connection itself, apart from people opening the console.
| From | To | Port | What for |
|---|---|---|---|
| People | 3AM | 8700 | The console. Through an SSH tunnel, or opened to your network |
| 3AM | Your tools | Each tool's API port, usually 443 | Alerts, checks, approvals and fixes |
| 3AM | Your model endpoint | Usually 443 | Investigations |
| 3AM | warden.3am.si | 443 | The licence check, hourly. Optional: licences also verify offline |
| The installer | get.3am.si | 443 | Downloading 3AM. Air-gapped sites carry it in instead |
A proxy is fine: set HTTPS_PROXY. Every port is listed in Network.
Access to your tools
To start, you need one monitoring source and one place to ask for approvals. Add the rest later.
| For | What to prepare |
|---|---|
| Alerts | Read access to Prometheus, Datadog, Grafana, Splunk or VictoriaMetrics, or a webhook from your SIEM |
| Approvals | A Slack bot, a PagerDuty key, Symphony, xMatters, Twilio or email |
| Fixes | A database user, a Kubernetes service account or an SSH key, each with the least access that works |
| Sign-in | Your identity provider (OIDC or LDAP), or a mail provider for emailed codes |
Each connector guide lists exactly what to create.
A licence
A free trial is the quickest way in: the installer can request it for you, and the code arrives by email. For a limited time trials last 90 days, not the usual 30, one per company.
Common questions
No. 3AM runs on Linux only, on a server or in Kubernetes. To try it from a laptop, install it on a small cloud VM and open the console through an SSH tunnel.
No. Without one, point 3AM at a model endpoint: your own, or OpenRouter. A GPU is only needed if you want the models on the same server.
The installer uses sudo for three things: installing Podman (it asks first), setting Podman up for your user, and
opening the console's port in the server's firewall when you choose to open it. 3AM itself runs as a non-root user in
locked-down containers.
Not yet. 3AM's images are built for x86_64, and the installer stops on other machines.
Yes. Download it on a machine that has internet, check it, and carry it in. See Air-gapped sites.