The same agent reports CPU and your security posture
Netwarden Security is a host-side posture monitor for Linux servers. It emits 14 finding types. CVE matching against Ubuntu USN, Debian DSA, and Red Hat OVAL (with NVD CVSS enrichment). SSH posture audit. Public-port exposure on 22 management ports. GeoIP-aware failed-login detection on a 60-second window. TLS certificate expiry. Every finding comes from the agent already running on your hosts. No separate scanner. No extra license.
Five capabilities, one agent
Every finding is grounded in real source data the agent already collects. No agentless probing, no cloud-side guesswork. The same install that monitors CPU and disk now watches your security posture.
CVE alerts on the packages you actually run
The agent inventories installed packages on every host. The platform pulls Ubuntu USN, Debian DSA, and Red Hat OVAL feeds, enriches each advisory with NVD CVSS for sharp severity routing, and joins the two. When a fixed version ships and you haven't applied it, a finding fires with the CVE, the affected package, and the version you need.
- Coverage: Ubuntu, Debian, RHEL, Rocky, AlmaLinux, CentOS, Amazon Linux. Fedora installs match against Red Hat advisories where applicable.
- Severity is routed via NVD CVSS (not just the upstream vendor severity), so the same CVE doesn't get different importance depending on whose feed you read.
- Auto-resolves on the next package snapshot once the upgrade lands. You don't manually clear a CVE you've already patched.
openssl 3.0.2-0ubuntu1.10 is affected by CVE-2023-0286
SSH posture audit on every connection
The agent reads sshd_config and the live algorithm advertisement. Eight finding types catch the settings that turn an SSH server into a brute-force target, plus the legacy crypto that lets old clients downgrade you.
- PermitRootLogin yes: high. PermitEmptyPasswords yes: critical.
- PasswordAuthentication yes: medium. Protocol 1: critical.
- Weak KexAlgorithms (SHA-1 family), Ciphers (CBC, RC4, CAST), MACs (MD5, 64-bit truncated). Flagged per category.
- X11Forwarding yes: low, but worth knowing on production servers.
SSH allows direct root login
Public-bind audit on management ports
The agent enumerates every listening socket. The platform flags management or database ports bound to a public address (0.0.0.0 or ::). Postgres, MySQL, MongoDB, Redis, Elasticsearch, the Docker daemon, RDP, MSSQL, Memcached. There is also a coarser anomaly: more public binds than loopback binds is unusual on a server.
- Per-port findings, not aggregated. Fix the Redis exposure without losing the open Mongo finding behind it.
- Service restarts don't duplicate the finding: PID and process name are stored but not part of the dedupe fingerprint.
- many_public_bindings fires when public binds exceed loopback by more than five. A coarse hint at an over-exposed host.
Management port 5432/tcp is exposed publicly
GeoIP-aware failed-login monitoring
The agent samples failed SSH logins from auth.log, journal, and equivalents on a 60-second window. Every source IP gets enriched against MaxMind GeoLite2. Two findings ride on top: a country-watchlist alert and a country-anomaly alert tied to the host's own 30-day baseline.
- High-risk countries (RU, CN, KP, IR, BY) trigger a high-severity finding once a country crosses 20 failed attempts in the window.
- Country anomaly fires when a host sees sustained failed-login traffic from a country it has never logged before in the prior 30 days.
- The dashboard surfaces sample IPs, country flags, and a 30-day prior distribution so operators can triage without leaving the page.
Failed SSH logins from Russia (47 in last minute)
TLS certificate expiration
Agentless. The platform reuses your existing HTTPS uptime checks: when it dials the host, it captures the peer certificate. A finding fires when the certificate is within 14 days of expiry and is escalated to critical at 3 days.
- No extra collector to install. Runs on the same dial used for HTTPS uptime.
- Issuer, subject, and notAfter are stored on the finding so you don't need to re-run openssl s_client to triage.
- Auto-resolves the next time the dial sees a renewed certificate. Renewals are detected without operator intervention.
TLS certificate for app.example.com expires in 2 day(s)
Severity-routed, three channels, one digest
Findings are tiered critical / high / medium / low and dispatched across email, mobile push, and outbound webhook. You decide which severities open which channel. You can also opt into a single weekly digest as a low-noise alternative.
Severity-routed dispatch
Every finding lands in one of four buckets: critical, high, medium, low. Per-tenant preferences decide which severities go to email, which to push, and which to your webhook. No noisy lows in your inbox unless you ask for them.
Auto-resolution
When you fix the misconfig, the next snapshot closes the finding on its own. Auto-resolved findings are tagged distinctly from user-resolved ones, so you can tell who did the work: you, or the platform recognizing your fix.
Time-to-resolution metric
Every finding tracks first_seen, resolved_at, and who closed it. The dashboard rolls those up into a time-to-resolution chart, so you can prove your security posture is improving instead of just feeling like it might be.
| Severity | Push | Webhook | Example finding | |
|---|---|---|---|---|
| Critical | default on | default on | default on | Empty SSH passwords, SSHv1 enabled, 2-day cert |
| High | default on | default on | default on | Public Postgres, root SSH, weak ciphers, RU brute force |
| Medium | default on | off by default | off by default | Password SSH auth, country anomaly, weak MACs |
| Low | off by default | off by default | off by default | X11 forwarding, hmac-sha1. Weekly digest only. |
Remediation built into every finding
Each finding ships with a copy-pasteable fix and a short ordered checklist. No jumping into someone else's blog post to figure out the right sshd_config edit.
Disable direct root SSH
# /etc/ssh/sshd_config — set PermitRootLogin nosudo sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' \ /etc/ssh/sshd_configsudo sshd -t && sudo systemctl reload sshd
Patch a flagged package
# Debian / Ubuntusudo apt updatesudo apt install --only-upgrade openssl# RHEL / Rocky / Alma / Fedorasudo dnf update openssl
Renew an expiring certificate
# Let's Encrypt — certbot renewalsudo certbot renew --dry-runsudo certbot renewsudo systemctl reload nginx
What this is not
We'd rather tell you up front. The security wedge is built around the agent we already ship. That buys real value. It also defines real boundaries.
Not a full vulnerability scanner
We don't do active port-and-protocol fingerprinting like Nessus, Tenable, or Qualys. Findings are derived from the agent's snapshots, not from probing the network.
Not an EDR
No kernel-level threat detection, no behavioural process anomaly, no signed-binary attestation. If you need runtime malware detection on each host, pair us with an EDR.
Not a SIEM
We do not aggregate every log line in your fleet. Failed-login monitoring uses sampled top-IP windows, not full ingestion. Bring a SIEM if you need long-term log search.
Not a compliance auditor
We do not certify you against PCI, HIPAA, or SOC 2 controls. Our findings (disabled root SSH, patched CVEs, public-port exposure) are useful inputs to those audits, but the framework itself isn't our product.
GeoIP needs your own MaxMind license
MaxMind's terms require each operator to hold their own GeoLite2 license. It's free at maxmind.com; you mount the .mmdb into the platform pod. Without it, every other security finding still fires.
Linux first today
SSH posture, listening-port audit, and CVE matching require the Linux agent. Windows and macOS hosts are inventoried but don't yet emit security findings beyond TLS expiration on monitored hostnames.
The whole security wedge ships in the self-hosted binary
CVE feeds, SSH posture audits, port-exposure findings, GeoIP failed-login monitoring, TLS expiration. Every capability on this page is in the same Bun-compiled binary you'd run yourself. Same evaluator, same remediation snippets, same dashboard. No feature gate.
Install the agent. Start finding things.
One install gets you uptime, metrics, and the security posture checks on this page. Free tier covers three hosts; paid plans add longer retention and unlimited webhooks.