eLLA - Settings, Options and Skills Reference

Applies to: ella 0.3.0 and later
Platforms: Ubuntu Linux 20.04, 22.04, 24.04; Windows 10/11; Windows Server 2019, 2022, 2025

Contents

1. Installation and first-time setup
2. Configuration file settings
3. Environment variables
4. File locations
5. Command-line commands and options
6. In-session slash commands
7. Approval modes and safety features
8. Certification readiness standards
9. System state baselines
10. Windows skills
11. Linux skills
12. Skills for both platforms
13. Built-in tools

1. Installation and first-time setup

Windows

1. Run ella-<version>-x64.msi. It installs to C:\Program Files\ella, adds ella to the system PATH and registers the ella Event Log source. The MSI can be deployed through Group Policy or Intune.
2. Open a new terminal with Run as Administrator.
3. Run ella setup and enter the endpoint URL, API key and model.
4. Run ella to start a session.

Requirements: Windows PowerShell 5.1 (built in). The Active Directory, Group Policy, DNS and DHCP features need RSAT or the role management tools. Upgrading with a newer MSI keeps the existing configuration.

Linux (Ubuntu)

1. Install the package that matches your release:
   • Ubuntu 20.04: ella_<version>_ubuntu2004-py38_amd64.deb
   • Ubuntu 22.04: ella_<version>_ubuntu2204-py310_amd64.deb
   • Ubuntu 24.04: ella_<version>_ubuntu2404-py312_amd64.deb
   Install with sudo apt install ./ella_<version>_<target>_amd64.deb. The packages are self-contained and install offline.
2. Run sudo ella setup. This writes /etc/ella.conf, creates the ella group and adds you to it.
3. Log out and back in (or run newgrp ella), then run ella.

Recommended: a model context window of 32K tokens. Set context_tokens to match your model.

2. Configuration file settings

The configuration file is in INI format and is owned by administrators because it holds the API key.

• Windows: C:\ProgramData\ella\ella.conf (readable by Administrators and SYSTEM only)
• Linux: /etc/ella.conf (owner root, group ella, mode 0640)

ella setup creates the file. You can edit it afterwards in any text editor. Changes take effect the next time ella starts.

[llm] section

[behavior] section

[gitlab] section (optional)

Example

[llm]
base_url = http://ellm.local:8000/v1
api_key = sk-xxxxxxxx
model = qwen3-4b
context_tokens = 32768
max_tokens = 4096
request_timeout = 180
stream = true
heavy_model = gpt-route

[behavior]
approval = tiered
reviewer = true
host_profile = true
typewriter = true

[gitlab]
base_url =
token =

3. Environment variables

4. File locations

The per-user data folder contains sessions (chat history), reports, skills (saved skills), logs, changesets (records used by undo) and backups (automatic pre-change backups).

5. Command-line commands and options

Global options

Commands

ella assess options

ella state commands

6. In-session slash commands

Type / in a session to see the commands available on that machine, or /help for the list. Add ? after a command for more detail, for example /remotes ?. You can also ask in plain English; the matching skill loads automatically.

General (both platforms)

Health checks

Each check is read-only and prints a PASS/WARN/FAIL list. Afterwards you can ask ella to write it up as a report, or to fix a finding (with approval).

7. Approval modes and safety features

Safety features

• Command classification. On Windows, each PowerShell command is parsed before it runs to decide whether it is read-only. On Linux, shell commands are classified by a rule set. Anything that cannot be classified is treated as a change.
• Change reviewer. A second model pass checks each proposed change and explains the risk before you approve it.
• High-impact confirmation (Windows). Tier-0 changes need you to type the computer name, for example changes to domain admin groups, the default domain GPOs, firewall profile state, recursive AD deletes or DC demotion.
• Automatic backups before changes (Windows). ella runs Backup-GPO before it edits or deletes a GPO, and exports a registry key before changing it, so the change can be restored.
• Undo. Every change is recorded in a changeset with its reverse action where one exists. Use ella undo.
• Pre-flight checks. Commands with syntax errors, or with passwords typed in plain text, are rejected before they run.
• Secrets. When a password is needed, ella asks you for it directly. It is passed to the command as a secure value and is never shown to the model, written to the logs or saved.
• Audit log. Every command, approval and result is recorded (see File locations).

8. Certification readiness standards

ella assess <standard> checks the machine against a standard and reports each control as PASS, FAIL, EVIDENCE (a document or record is needed), ADVISORY, UNKNOWN or N/A. Questions about the organisation that cannot be checked on the machine are asked once and saved. Run it from an elevated terminal (Administrator or root) for complete results. In a session you can ask ella to explain a gap or fix it; fixes need approval.

Examples:

ella assess cyber-essentials --level plus --deep
ella assess dcc -l L2 --answers \\fileserver\it\ella-answers.json --json dcc-pc01.json
ella assess iso27001 --no-questions

9. System state baselines

A baseline records the security-relevant state of the machine. You can then ask what has changed since, and how those changes affect a standard. Snapshots are stored on the machine itself (see File locations) as compressed files. Passwords, password hashes, private keys and credential stores are never captured.

Recorded on Windows: local users and groups, Active Directory users, groups and privileged membership, GPOs, firewall profiles and rules, services, scheduled tasks, startup items, installed software, installed updates, Windows features, shares, certificates, Defender settings and exclusions, local security policy, audit policy, BitLocker, network configuration and listening ports, the hosts file, and the DNS, DHCP and IIS roles where installed.

Recorded on Linux: users (lock state only) and groups, SSH authorised keys, firewall rules (ufw, nftables or iptables), services and timers, installed packages, network interfaces and listening ports, key configuration files (including sudoers, SSH, PAM and cron), and Docker containers.

Each change is given a severity (high, medium, low or info) and linked to the ISO 27001, Cyber Essentials, DCC, PCI DSS and Essential Eight controls it affects. Changes made through ella are identified as such.

Typical use:

ella state baseline                       (after a build or before an audit)
ella state diff                           (what has changed since the baseline)
ella state diff --impact iso27001         (and how it affects ISO 27001)
ella state diff --from pre-audit --min medium

In a session you can ask the same in plain English, for example "what's changed since the baseline?" or "how do these changes impact ISO 27001?". Take baselines and later checks at the same privilege level (both elevated) so that the comparison is complete.

10. Windows skills

Skills load automatically when a request matches their subject. Except where noted, they are read-only. Changes suggested from their findings need approval.

11. Linux skills

Remote machines (Linux): ella can manage other Linux machines over SSH. Ask in plain English, for example "add remote web01 at 10.0.0.5 user root", "set up an ssh key to web01" or "is nginx running on web01?". Use /remotes to list saved hosts. Passwords are asked for once to install a key and are never stored. Windows remote management (WinRM) is planned.

12. Skills for both platforms

Your own skills: when ella writes a useful diagnostic script during a session, you can ask it to save the script as a skill. Saved skills are stored in your per-user data folder and managed with ella skill. They can be exported and imported to share with colleagues.

13. Built-in tools

These are the actions ella can take during a session. You do not call them directly; ella chooses them based on your request.