HomeToolsDocsPricingGalleryExtensionContact Get the App
Docs / Quickstart
// start here

Quickstart

Before you start

Legion runs on macOS 12 or later and Linux (Debian 13, Ubuntu 22+, Kali).

Authorized use only. Only run Legion against systems you own, administer, or have written permission to test. Define scope before using the AI Operator.

Step 1. Download

Go to the pricing page and download Legion. The trial is free for 3 days, full access, no card required. Pick the installer for your OS.

Step 2. Install

macOS: Open the .dmg and drag ThreatStrike Legion into Applications. Launch it from there. If macOS blocks it on first open, go to System Settings, Privacy & Security, and click Open Anyway.

Linux: Install the .deb, .rpm, or .AppImage for your distro. For Ubuntu and Debian:

sudo apt install ./threatstrike-legion.deb

Step 3. Start your trial or enter your key

On first launch you'll see a screen to enter your license key or start the 3-day trial. Hit the trial button to get in immediately, no key needed.

Step 4. Pick a mode

Choose red team or blue team. Red team is the offensive side, blue team is DFIR and defensive tooling. You can switch between them at any time using the toggle in the top right of the app, so don't overthink it.

Step 5. Download your tools

Go to the Downloads section inside the app and install the tools you want to use. You can grab them all at once or pick individual ones. Legion does not bundle the toolset, it downloads and manages them for you.

Step 6. Create an engagement

Click New Engagement and give it a name and scope. The scope tells Legion and the AI Operator what targets are in bounds. Everything you find, hosts, services, credentials, screenshots, gets stored under that engagement.

Step 7. Run a tool or use the AI Operator

Running a tool manually: Pick any tool from the sidebar. Fill in the form fields and hit Run. The output comes back in the area below the fields.

Using the AI Operator: Open the Operator tab and type a plain-English objective, something like enumerate 10.10.10.10 and find open ports. The agent drives the tools, reads the output, and keeps going. You can approve each command before it runs or let it run automatically.

The AI Operator needs an API key. Go to Settings and add your Anthropic, OpenAI, or Gemini key, or point it at a local model. If you skip this, every tool still works, you just drive them yourself.

What's next

Check the Installation page for more detail on setup, updates, and licensing. If something's not working, email security@threatstrike.ai.

Download Legion Back to Docs