Read on the host. Decide on errorgap.
The agent reads the host
Config, keys, packages and listening ports, on the same errorgap-agent that ships logs and metrics.
Rules run on errorgap
Not on the host, so rules update without an agent release.
Severity, evidence, fix
Each finding carries the lines it was read from and fix commands per distro: Ubuntu/Debian or RHEL family.
The changes that matter
High findings, new SSH keys, file changes and new ports raise alerts.
Six views of one host.
Who got in, and from where.
SSH and web sign-ins on one timeline. Web sign-ins arrive through the SDKs you already send errors with.
- New-country and unusual-hour detection
- Shared-account detection
- Expected-login rules to quiet the known ones
Findings with the fix.
A finding panel shows the evidence lines, a path-to-root chain for sudo, and fix commands for your distro. If a finding is intentional, accept it with a reason; the acceptance is audit-logged.
- Evidence lines from the file that triggered it
- Ubuntu / RHEL fix tabs
- Accept with a reason, audit-logged
Vulnerabilities and end of life.
Installed packages matched against OSV, with severity and the version that fixes each one. An end-of-life banner appears when the OS itself stops getting updates.
- OSV matching per installed package
- Fixed-in version per advisory
- OS end-of-life banner
What’s listening, and who can reach it.
Listening sockets with the process and container behind them, firewall state, and a history of ports that opened or closed.
- Process and container per socket
- Firewall state per host
- Port-change history
Watched files, diffed.
sshd_config, sudoers, authorized_keys and the rest of the watch list, diffed with a plain summary. Secrets are masked on the host before anything is sent. Sign-ins and deploys near the change are shown as possibly related.
- Plain-English summary per diff
- Secrets masked on the host
- Nearby sign-ins and deploys linked
A plain-English read, scoped to the OS.
One click for an explanation of a finding written for this host’s distro and setup. It sits beside the deterministic fix and never replaces it.
- Runs on an errorgap-run model
- Prompts are redacted first
- Included on Team and above, with a daily allowance
What leaves the host, and when.
Secrets masked on the host
Tokens and passwords in watched files are replaced before the agent sends anything.
Key blobs shortened
SSH keys are reported as fingerprint, type and comment, with the key itself shortened.
Contents only on change
File contents are sent when a watched file changes, not on every snapshot.
Silent baseline
The first snapshot sets the baseline without raising alerts, so installing the agent doesn’t cause an alert storm.