Skip to main content

Security

The Security module folds the fleet's security signals into one place. The signals themselves come from the agent read-only probes described in Host security and Patch, backup, cron.

Overview​

KPIs across the fleet: pending updates, security updates, critical vulnerabilities, SSH failures over 24 hours. The year strip below plots the security history per day (auth failures, root logins, brute-force events, OOM kills, integrity changes); days with integrity events are flagged. Click a day to pin the whole module to it.

The host selector narrows every tab to one box, and the host page's security card deep-links here the same way.

Patches​

Per-host pending updates and security updates, worst first. Fully patched hosts fold into a quiet "fully patched" pill instead of cluttering the table.

Known vulnerabilities​

CVEs matched against what is actually installed on your hosts, with severity, the affected packages, which hosts carry them, and the version that fixes it. Every verdict shows its source: severity prefers your distribution's own assessment over the generic CVSS score, so a vendor-rated-medium does not scream critical, and where only the raw score exists the pill says so. A vulnerability that is known to be exploited in the wild is marked, treated as critical regardless of anyone's triage, and always alerts. Where a fix exists only behind the distribution's extended-support subscription, the finding says that instead of pretending an upgrade will arrive.

The per-host incident is deliberately narrower than the page: it counts critical findings that are actionable, fixable in your release or actively exploited. A critical with no fix anywhere stays visible here as posture but does not page anyone, because there is nothing to run.

Hardening​

The hourly hardening scan's results: a fleet score, and per-host findings from the CIS-subset checks (file permissions, SSH doors, kernel hardening flags, audit daemon and firewall presence, password policy), each with severity and what to change. The check details are described in Host security.

SSH access and integrity​

Who is hammering SSH (top attacking sources with countries), accepted and root logins, and the file integrity trail: changes to the identity-critical files raise events, and changes to the compromise-grade ones (passwd, shadow, sudoers) raise an incident.