A security finding, from detection to decision.
Three sample steps with sample data: an attack on a server's login, the automatic block an eligible plan places in Automatic mode, and a separate change that waits for a person. Nothing on this page touches a real server or a real account; every button changes this page only.
Sample data. The hostnames, counts and findings below are examples built for this page, not a customer's activity.
Step 1: the finding
The agent on web-01 reads the authentication log as sshd writes it and reports failed logins with the attempted username and the source address. The platform counts sightings per address: this address has now failed in three separate reports within thirty minutes.
Step 2: the automatic block
Choose the mode the sample server runs in. In Automatic, which every paid plan includes, the block is queued without asking and the agent applies it at its next check-in through the firewall the server already runs. In Awaiting Approval the same finding becomes a proposal for you.
Step 3: a change that waits for you
The same server accepts passwords over SSH from any address, which is what made the attack possible. SecAI proposes the fix with what it will run, why, the effect and how it is undone. It never applies it on its own, in either mode.
The same story in the dashboard
The panels below are the illustration the homepage shows, with the same sample data.
Sample data. The hostnames, counts and findings below are examples built for this page, not a customer's activity.
Make server security easier to understand.
See how SecAI works, then evaluate it with the person who manages your Linux servers.