Data collected

Collected

• Host identity: hostname, OS, version and kernel, architecture, agent version, interfaces and addresses.
• Metrics: CPU, memory, disk, uptime, network byte counters.
• Inventory: installed packages and versions, listening ports, running services, cron entries, discovered websites (hostname, port, TLS).
• Authentication: SSH events with the log line, attempted username and source; interactive sessions (user, source, method, key fingerprint, open and close times).
• Processes: for a suspicious process, PID, executable path, command line, and whether the binary was deleted while running.
• Network: unusual outbound connections (remote address, port, owning process); flood and connection-exhaustion measurements.
• Files: paths and hashes of monitored files; for changed persistence files (cron, sudoers, authorized_keys, systemd units) the text before and after, within a small limit, never binary.
• Accounts and privilege: local accounts and their attributes, groups, sudo grants, SSH public-key fingerprints, setuid binaries, capabilities.
• Posture: pending updates, firewall state, disks, failed units, certificate metadata, time sync, backup status, effective SSH configuration.
• Suspected web shells: path, size, SHA-256, matching rule, first 200 bytes.
• Survival record: kernel counters and actions during an outage or exhaustion episode.

Never collected

• Contents of databases, application files, uploads, mail or customer records.
• Password hashes (/etc/shadow is read only for an empty-password yes/no).
• Private keys, packet contents, shell sessions, keystrokes, process environments.

Where it goes

Over TLS to secai.techsteps.ae, stored per organisation. AI audits send findings, package versions and configuration state to OpenAI (United States). Package names and versions are queried against OSV.dev. Attacking addresses are looked up at TheIpAPI; your own addresses are never sent. The Privacy Policy lists every processor.