Dusk Sentinel watches your server logs, shows every attack attempt on a live dashboard as it happens, and alerts your phone, chat or inbox. It can also block the attacker in the host firewall automatically.
Reads SSH, sudo and web access logs to spot brute force, unknown users, admin-panel probes, scanners and exploit payloads such as Log4Shell, SQL injection and path traversal.
Groups events per attacker into campaigns like 'SSH brute force in progress', so one noisy address produces one alert an hour instead of hundreds.
Blocks attacking addresses in the host firewall for 24 hours, doubling for repeat offenders up to 30 days, with a never-block list and an Unblock button.
Web push to your phone with no third-party service, webhooks for Slack, Mattermost and Discord, email, and an optional daily digest.
Canary usernames and URLs trigger a critical alert and an instant block, and decoy ports hold scanners open while the dashboard totals the time wasted.
Enrol other machines with a one-time token and see every device's events, alerts, blocks and exposure findings in one place.
Runs on: Linux servers today, with macOS and Windows builds on the way. Self-contained executable, dashboard served behind your HTTPS proxy.
Dusk Sentinel is up and running, with access kept private while we polish it. Leave your email and we will let you know when you can use it.