ACTIVE BLOCKS0Linux firewall rules managed by GuardOBSERVATIONS0Normalized security evidence retained locallyLIVE COLLECTORS0Enabled evidence sourcesENGINEACTIVECorrelation and response policy
RECENT ACTIVITY
Security timeline
DEVELOPMENT
Simulation collector
EVIDENCE
Security events
Time
Source
Country
Collector
Protocol
User
Decision
Enforcement
Score
Reason
RESPONSE
Blocks
IP
Country
Created
Expires
Collector
Reason
Status
TRUST
Learned safe list
Candidates are learned from successful authentication. Trusted entries are exempt from Guard blocking while fresh, and may be shared through Datacenter policy.
IP
State
Successes
Distinct days
Protocols
Users
First seen
Last seen
CUSTOM MONITORS
Create your own Guard monitor
LOG FILE
Point Guard at a text log file or rolling log directory, paste an example of the evidence, and define how to recognize it. A matching source IP is normalized into the ordinary Guard correlation and blocking pipeline.
Compact monitor list
Name
Source
Location
Category
Protocol
Source / trust
Triggers
Last trigger
Email
State
COMMUNITY
Scantide Monitor Catalog
Browse Scantide Verified and community-shared monitors. Downloaded monitors are installed disabled so you can review paths, language patterns and extraction rules before enabling them.
New custom monitorCreate a separate monitor. Existing monitors are not changed.
Block & alert policyUses global Guard rules by default
Leave override off for normal behavior. Different applications can use their own thresholds without changing Guard's global policy.
LOG SOURCE
Single file or rolling log directory
File
Modified
Size
SAMPLE
Evidence to analyze
PASTED / SELECTED
EXTRACTION
Recognition and fields
Successful-login event classOptional — same source/parser
Add a second recognition rule to the same monitor. Successes are recorded separately, can reset the related failure counter and feed trusted-host learning; they are never evaluated with the failure blocking threshold.
Languages / localizationOptional
Configure localization after the source and extraction rules are working. Use * for language-neutral patterns.
LANGUAGE VARIANTS
Localized recognition patterns
Add alternative wording for localized logs without duplicating the monitor. Guard prefers the current OS/UI language, then falls back to the base pattern.
Use Analyze & test sample for the easiest setup: Guard proposes the matching phrase, source IP, username and authentication type, then validates it immediately. Successful authentication can contribute to trusted-host statistics. Rolling-folder monitors continuously discover new matching filenames. Regexes may use named groups ?<ip> and ?<user>.
AUTOMATION
Custom actions
LOCAL EXECUTION
Run an administrator-defined executable or script when Guard creates a block, observes a successful login, or a custom monitor triggers. Each argument is passed separately after placeholder substitution.
Placeholders: {trigger}, {ip}, {country}, {countryCode}, {reverseDns}, {collector}, {protocol}, {username}, {reason}, {server}, {timestamp}, {category}, {summary}, {enforcement}, {monitorId}, {monitorName}. The same values are also exposed as SCANTIDE_* environment variables.
Name
Triggers
Executable
Runs
Last run
Status
ASSESSMENTS
Server health, certificates and security posture
CHECKING
Linux Guard uses the same assessment contract as Windows: CPU, memory, filesystems, services, network/firewall, package intelligence, certificate discovery, TLS/cryptography posture and report delivery. Platform-specific checks are identified explicitly.
Started
Assessment
Status
Checks
Report
Unified server assessment
Includes TLS/cryptography posture. Guard reports findings only and does not change OpenSSL, system crypto policy or application TLS configuration.
Certificate discovery & renewal readiness UNDER DEVELOPMENT
Experimental — reconnaissance and validation only. Linux Guard discovers local certificate files, including common OpenSSL, Nginx, Apache, HAProxy, Let's Encrypt and CrushFTP locations, inspects chain/private-key state where readable, and validates a configured GoDaddy or PowerShell renewal candidate. This phase never installs, replaces, exports or rebinds a certificate.This feature is under development and must be thoroughly tested in a non-production environment before relying on it in production.
TLS & cryptography posture
Local TLS posture
Read-only inspection of OpenSSL/system crypto policy and discovered service configuration.
NOT QUERIED
Run the TLS query to build the protocol overview.
Raw TLS / cryptography evidence
Run the query to inspect this server.
Client and server protocol states are shown separately because Schannel can enable a protocol for outbound client use while disabling it for inbound server use, or vice versa. Remediation is informational only; test application compatibility before changing TLS or cipher policy.
Local certificate discovery
Manual certificate reconnaissance
Run these checks on demand. They are read-only and do not export, replace or bind certificates.
No manual certificate reconnaissance has been run in this browser session.
Password-protected PFX/P12 files are listed even when Guard cannot inspect their contents without a password. Discovery is read-only.
Renewal readiness
GoDaddy provider
GoDaddy credentials are stored using Guard's protected settings store and are never returned to the browser.
Custom provider
Validation schedule
Report delivery
Catch window and immediate username blocking
Count related security events from an address within this period. Maximum: 30 days. A longer period detects slower attempts but retains more history in memory; counters restart with the service.
Exact, case-insensitive matches only. Use DOMAIN\\name when that is what the collector reports. Only trusted authentication failures can trigger this rule; successful logins and arbitrary web parameters never do. Trusted/private-address protections and the automatic-blocking switch still apply. Fleet propagation is optional and requires Datacenter. Leave the username list blank to disable.
LOCAL POLICY
Response settings
Use the catch-window controls below; managed servers receive their thresholds from Datacenter.
Local allow-list and block-list
Manage local trusted addresses and manual blocks in Local lists. Datacenter-managed entries are labelled separately.
ESCALATION
Repeat offenders
Only separate automatic block episodes count. Attempts made while an address is already blocked do not add occurrences. A permanent block has no expiry and remains until manually released or allow-listed.
SHARED RESPONSE
Datacenter shared blacklist
Only public IP addresses are propagated. Shared blocks are permanent desired state; removing an address from the shared list releases only blocks that were created from that shared policy, never an independent local permanent block.
TRUST LEARNING
Automatic safe list
Successful Windows/RDP and SSH authentications become candidates first. Once the configured confidence threshold is reached, the source is trusted and exempt from normal blocking and future panic-room/global blocking. Static whitelist entries still have highest priority.
INTELLIGENCE ROUTING
Reputation and cache status
0.8.4
Shows where Guard obtains external intelligence. Managed Guards prefer Datacenter as the shared cache/broker. Only publicly routable addresses are eligible for Internet reputation lookups.
Loading intelligence status…
SCANTIDE API
Scantide account
NOT CONFIGURED
Adds Scantide vulnerability/lifecycle intelligence and central enrichment to assessments. This account is separate from the Guard license.
Source: checking…
SERVICENOW / CMDB
LAN discovery → CMDB awareness
NOT CONFIGURED
Adds CMDB context to LAN scans by matching each discovered IP against ServiceNow. Guard is read-only against ServiceNow in this release.
Source: checking…
NETWORK LOCATION
Country and Tor blocking
The local allowlist always wins. Country decisions remain event-driven and fail open when lookup is unavailable. Tor blocking is independent of AbuseIPDB and preemptive: the complete Tor exit list is synchronized into dedicated nftables sets and input-chain rules.
COLLECTORS
Authentication and application collectors
Collectors can be enabled locally or by a Datacenter server policy. Unsupported collectors remain harmless on platforms where their source is unavailable. CrushFTP auto-discovers common installations and can also follow explicit local log roots.
PER-COLLECTOR POLICY
Independent block & alert rules
Built-in monitors inherit global Guard rules by default. Override only applications that need a different threshold, window, block duration or block-alert behavior.
WEB PROTECTION
Apache, Nginx, Tomcat, WildFly and HAProxy
Effective profile contents — inspect exactly what this profile will detect and block
Editable policy: removing a built-in rule is persistent. Guard will not silently add it back on restart or Datacenter refresh. A bare * rule is rejected because it would match every request. Use the reset buttons to restore the Scantide baseline.
Standard immediately blocks high-confidence secret, credential, traversal and web-shell probes while ordinary reconnaissance contributes to the normal Guard threshold. Monitor only records these requests without single-request immediate blocking.
Guard auto-discovers local web access logs, including HAProxy configuration and common rsyslog/journald sources. HAProxy frontends/backends are preserved in events, and forwarded client headers are trusted only from explicitly configured upstream IP/CIDR entries. Dangerous path matches enter the normal Guard policy immediately. Generic scanner activity is detected when the same source produces many 4xx responses across many distinct paths in a short window.
STARTUP & ENRICHMENT
Event processing
Scantide API credentials: checking source…
Startup history is evaluated only when Guard starts. Saving a change requires restarting Guard. Imported events can trigger normal policy decisions, so use a limited lookback. Geo-IP uses a cached HTTPS lookup; AbuseIPDB is optional and requires an API key. Intelligence is informational and never changes a block decision.
SCANTIDE GUARD LICENSE
Guard licensing
NOT CHECKED
Fresh installations include a 30-day local evaluation. Registered trials/licenses use a 72-hour offline grace if licensing connectivity is temporarily unavailable. The countdown is shown below.
No license check has completed yet.
Operational risk / AS-IS software. Scantide Guard is provided AS IS, including when licensed or subscribed. Security enforcement, blocking, certificate/TLS functions, configuration changes and third-party integrations can cause service interruption, loss of connectivity, blocked legitimate traffic or other operational impact. To the maximum extent permitted by applicable law, Scantide does not assume responsibility for service disruption, downtime, data loss, lost revenue or other damages arising from installation, configuration or use. Test changes, keep backups and independent administrative access, and validate all production decisions. Nothing here limits liability that cannot lawfully be limited. See LICENSE-AND-DISCLAIMER.txt and the administrator manual for the full notice.
Guard licensing is separate from Scantide API credentials. Datacenter-managed Guard can also receive these credentials centrally.
LIFECYCLE
Updates and retention
NOT CHECKED
CURRENT—
→
AVAILABLEChecking…
CheckingDownloadingVerifyingInstallingRestarting
Linux Guard downloads only HTTPS packages, verifies the Scantide-published SHA-256, then launches the packaged install.sh through a transient systemd update unit so the Guard service can safely replace and restart itself.
NOTIFICATIONS
Email alerts
Emails when a safe/allow-listed IP reaches a blocking threshold. The exemption stays in place; no block is applied. Repeated warnings use the per-IP cooldown below.
Save before testing. The test uses the same layout as a real block alert but does not create a firewall rule.
Trust a Datacenter
Option 1: import the enrollment package copied by your administrator. Option 2: enter its HTTPS hostname below, select its public CA certificate and enter a one-use enrollment code.
No new certificate selected.
Hostname alone cannot establish trust. Guard will not accept unknown certificates or fall back to HTTP. Importing a fresh enrollment package can replace stale credentials even when the hostname/CA is unchanged. Use Forget Datacenter to return this Guard to standalone mode.
MANAGEMENT
Datacenter console
Not configured
Guard initiates trusted outbound HTTPS connections only. After enrollment, the one-use code is replaced by a unique agent credential. Unknown Datacenters and HTTP connections are never accepted.
SAFETY
Local allow-list / whitelist
Allow a trusted source IP or an entire CIDR network. Allow-listed sources are observed but never automatically blocked. Adding an entry also releases any matching active Guard block.
Loopback addresses are permanently protected and cannot be removed.
Local block-list / blacklist
Manual blocks are permanent until unblocked. Enter a single IP address; trusted and allow-listed addresses cannot be blocked. Changes below are saved immediately.
Address
Source
Reason
Expiry
Action
ALIENVAULT OTX
Open Threat Exchange
Correlates attacker IPs with OTX pulses and tags. OTX is enrichment-first; automatic blocking is opt-in and safelists always win.
Source: checking…
CROWDSEC
CrowdSec remediation decisions
Consumes CrowdSec LAPI ban decisions using bouncer authentication. Guard enforces them through its own firewall provider while preserving CrowdSec provenance.
Status: checking…
SCANTIDE GLOBAL REPUTATION
Global blacklist / reputation
NOT CONFIGURED
Use Scantide's licensed Global Blacklist and optionally contribute eligible attack intelligence. Client identity and authentication are provisioned automatically from the active Scantide license; administrators do not need to manage client IDs or secrets.
Source: checking…
Status: waiting for license enrollment.
Advanced behavior
Client identity, account mapping and authentication secrets are provisioned automatically from the active license and are intentionally not exposed here.