What You Get
Every report is a premium, audit-grade artifact — hand it directly to your auditor.
Simplified preview — click here for full sample report
The AI writes a framework-specific 3-bullet verdict: Workload Profile, Anomaly Assessment, and Compliance Status — tailored to SOC 2, HIPAA, PCI DSS, or NIST.
SVG charts overlaying nominal file changes against detected security anomalies across the full reporting period, with maintenance window highlighting.
Every detected anomaly is categorized as CRITICAL, HIGH, MEDIUM, or LOW — from unauthorized privilege escalation to minor policy deviations.
Deep-search across your entire fleet's file activity. Filter by host, process, and file for MODIFY, DELETE, or any other event — forensic-level visibility beyond the executive report.
Push reports to Slack, Discord, or any custom HTTPS endpoint. Full gzipped JSON payload for SIEM ingestion, or your own tooling.
Built-In Threat Detection Categories
Every anomaly is automatically classified by severity. The AI never suppresses genuinely suspicious activity.
/etc/shadow, /etc/passwd, /boot/, /bin/ — unauthorized password changes, user modifications, or privilege escalations.authorized_keys modification, systemd service backdoors, or dynamic linker hijacking via ld.so.preload.truncate, rm) and interactive edits applied to /var/log/, indicating attempts to cover tracks..bashrc, .profile, and system-wide profile directories — "execute-on-login" attacks.tar, zip, or 7z.chmod, chown, chattr, setcap.vim, nano) of config files outside standard home directories.sftp, tftp), downloads (wget, curl), and unarchiving for potential payload drops.www-data modifying non-web files — strong web-shell indicator./etc/, ensuring visibility into service and policy changes.apt, dnf, snap, pip, npm outside maintenance windows.