Features · Security & Backup · Policy Engine

Security & Backup · Policy Engine

Continuous checks,
not point-in-time audits.

Define policies — “all prod hosts have offsite backup”, “SSH access only via Gatekeeper”, “every host has env + owner tags”. The engine evaluates continuously and shows violations as they happen, not at audit time.

policies · 47 hosts

offsite backup on prod 44 / 44

SSH only via Gatekeeper 41 / 47

env tag present 47 / 47

agent up to date 45 / 47

checked continuously

— Why this matters

Compliance drifts back. Checking once proves nothing.

A one-time audit is a photograph.

Someone opens port 22 three weeks later and the report still says you passed. Rules run every five minutes instead.

"Broken for eleven days" is the answer auditors want.

Violations are durable records with a first-seen and a last-seen, and they resolve themselves when the next evaluation passes — so the duration is a fact, not a reconstruction.

Not every rule applies to every host.

Target by tag selector, hostname glob, or the whole fleet. A staging box should not fail your production policy.

— What's included

What it checks, and what happens when it fails.

Nine built-in rules

SSH off port 22, no firewall port open to the world, Fail2Ban running, Gatekeeper in use, and more — extensible through the rule registry.

Five categories

Security, performance, compliance, cost and reliability, so a policy set reads as something other than a security list.

Five severities

Info through critical, because "the agent is one version behind" and "SSH is open to the internet" are not the same finding.

Every five minutes

Scheduled and non-overlapping, with a re-evaluate button when you have just fixed something and want to see it clear.

Durable violations

First seen, last seen, auto-resolved on the next passing check.

Acknowledgement

Open violations can be acked with a note and an attributed user, for the ones you have decided to live with.

Events that travel

policy.violation.new and .resolved flow into the timeline, your notification channels and any SIEM forwarder.

— How it works

Checked every five minutes, not once a year.

Scope the rules

Not every rule applies to every host, so rules carry a scope rather than a fleet-wide assumption.

Evaluate continuously

Nine built-in rules across five categories run every five minutes.

Track how long

A violation records when it started, so the answer is "broken for eleven days" rather than "broken".

— Works with

Connected capabilities

— FAQ

Questions, answered honestly.

Can a policy block an action, or only report on it? +

Both. Default is "report"; "enforce" stops the action (e.g. block enrolling a host without required tags).

Are policies versioned? +

Yes — every edit produces a new version, signed, with diff. Useful for audit.

How are exceptions handled? +

Per-host or per-tag exception with mandatory reason + expiry. Expired exceptions automatically re-enforce.

Discovery & Mapping

For developers

Continuous checks,
not point-in-time audits.

Compliance drifts back. Checking once proves nothing.

A one-time audit is a photograph.

"Broken for eleven days" is the answer auditors want.

Not every rule applies to every host.

What it checks, and what happens when it fails.

Checked every five minutes, not once a year.

Scope the rules

Evaluate continuously

Track how long

Connected capabilities

Questions, answered honestly.

Continuous compliance, not annual scramble.

Continuous checks,not point-in-time audits.

Compliance drifts back. Checking once proves nothing.

A one-time audit is a photograph.

"Broken for eleven days" is the answer auditors want.

Not every rule applies to every host.

What it checks, and what happens when it fails.

Checked every five minutes, not once a year.

Scope the rules

Evaluate continuously

Track how long

Connected capabilities

Questions, answered honestly.

Continuous compliance, not annual scramble.

Continuous checks,
not point-in-time audits.