Your Linux hosts.
A clearer picture.

Resource metrics and security findings in one view. See what changed on a host, and the evidence behind the alert.

For homelabs, game-server hosts, and small operations teams running Linux.

What it watches

Watch the resources.
Investigate the changes.

A native agent collects host metrics and security-relevant inventory. Findings are indicators to investigate, with context and coverage limits.

01Host resource metrics: Follow CPU, load, memory, disk activity, network interface counters, filesystem usage, and cgroup v2 service resources.
02Account and persistence changes: Watch for new local UID-0 accounts, duplicate UIDs, shell changes, authorized_keys changes, and persistence configuration changes.
03Process security signals: Investigate deleted executables, fileless execution, and process masquerading indicators. Findings include context; legitimate updates can also trigger signals.
04Game-server process behavior: Flag a game server spawning a shell, interpreter, or downloader. Legitimate plugins may do this too; review the parent-child evidence.
05Container context: Attribute visible processes to supported container runtimes using cgroups and available read-only metadata. Coverage depends on host permissions and visible processes.
06Evidence and alert lifecycle: Review evidence snapshots, acknowledge or resolve alerts, and inspect collector health and coverage gaps. Missing visibility does not mean a host is clean.

Local work. Clear results.

01
Install and enroll
Install the native systemd agent on a supported Linux host. Configure the server, enroll with an administrator-issued token, and start the service.
02
Collect on the host
The agent reads resource counters and security inventory within its permission and collection budgets. Collector health makes gaps visible.
03
Review the evidence
Host telemetry and bounded inventory travel over verified HTTPS. Server-side rules produce findings with evidence to help you investigate.

A watcher for your corner of the world

Open the Stack Snack console to watch your Linux hosts and investigate what changes.