Server protection that watches, and leaves the controls with you
Attackers who get past a website often go for the servers behind it. Guardian's server agent watches your Linux servers for the early signs of a break-in and tells your team in time to act. It is read-only by design: it reports what it sees and never changes anything on its own.
What the agent watches
- Sign-ins. Successful SSH logins, failed attempts per address and bursts of password guessing.
- Accounts. New or removed local users, and changes to administrator groups.
- Unexpected changes. Changed, added or removed files in key system settings, scheduled tasks, services and, if you choose, your website's code folder.
- Risky activity. New listening ports, programs running from temporary folders and connections to addresses on your Guardian block list.
- Disk encryption. Whether your volumes are encrypted.
- Exposed personal data. If you choose, the agent also scans folders that hold exports, uploads or backups for personal data and secrets, as described on the data protection page.
Read-only by design
Many institutions cannot allow an outside service to run commands on production servers. Guardian does not ask for that. The agent reads and reports. When Guardian recommends a response, such as disabling an account or closing a port, that step is queued in the console for a person to approve. Your administrator carries it out and marks it done.
This keeps decisions with the people who are accountable for the system, and leaves a clear record of who approved what and when.
Installing the agent
An administrator creates a one-time enrolment token in the console and runs a single command on the server. The installer checks the agent file before it installs it. The agent needs Node.js 18 or newer and runs on common Linux distributions. Servers that cannot download files can be installed from a copied folder instead. Each server then appears in the console with its status and findings.
Removing it is just as simple: uninstall the agent and the server stops reporting.
Fits incident reporting duties
Indian organisations covered by CERT-In directions are expected to report certain cyber incidents within six hours of noticing them. That is only possible if someone notices quickly. Guardian sends email alerts for findings that need a person and keeps a timestamped record of what it observed, which your team can use when deciding whether and what to report. The decision and the report remain yours.
One console with your websites
Server findings appear in the same console as website protection, with the same team roles and audit log. A monthly report summarises what was found and what was resolved.
What you see in the console
Each enrolled server appears with its last check-in, its findings and anything waiting for approval. Findings are written in plain language, such as a new administrator account or a program running from a temporary folder, with the time it was seen and the server it came from. Important findings trigger an email alert to the people you choose.
Team roles decide who can see servers and who can act on them, and every action in the console is written to the audit log.
Why read-only matters
A security tool that can change your servers is itself a target. If it were ever misused, it could do the damage it was meant to prevent. Keeping the agent read-only, running it as its own limited system user and signing everything it sends means the agent adds visibility without adding a new way in.
Getting started
Request access and tell us what you need protected. Our team verifies your organisation and the people who will hold access. Once approved, a website can be protected the same day through a DNS change, and server and data protection start as soon as your administrator installs the agent. You can leave at any time by pointing DNS back and uninstalling the agent.
Questions
Can Guardian run commands on our servers?
No. The agent is read-only. Suggested responses are queued for your administrator, who carries them out.
Which systems are supported?
Linux servers with Node.js 18 or newer. If you have other systems, tell us about them when you request access.
Does the agent send our files to Guardian?
No. It sends security events, file paths and counts, never file contents. Each batch is signed by the server so it cannot be altered on the way.
Can we use it on servers that are not public websites?
Yes. The agent works on any Linux server that can reach Guardian, including internal application and database servers.