Security visibility
SecWatch
Practical self-hosted security monitoring without a giant enterprise stack.
One readable tool for edge detection, auto-ban, host visibility, CVE awareness, file integrity, and optional local-model traffic analysis.
Public, sanitized project material.
The problem
Why it exists
Small self-hosters need to know what is hitting the edge, what changed on the host, and whether the monitoring pipeline itself still works.
Assembling and operating several enterprise-shaped tools can become more work than the systems they protect.
- SecWatch is a monitoring and mitigation aid—not a firewall or patch manager.
- Its intentionally focused scope does not replace a mature SIEM for organizations that need one.
Architecture
Operating model
Capabilities
What it does
Security
Trust model
- Public-interface guardrails prevent an accidentally open dashboard.
- Security-critical configuration stays reviewable and separate from convenience settings.
- Synthetic fire drills verify detect-to-enforce behavior and restore state byte-for-byte.
Tradeoffs
Key decisions
Evidence before alerts
Every ban retains why it happened and the source that triggered it, so the operator can review and reverse it.
Self-health is part of security
A dead-man’s switch and fire drill test the monitoring pipeline rather than assuming a running process means protection.
Current state
Current state
- Multi-source detection and ban evidence
- Host, process, egress, and persistence checks
- Dashboard, alerting, metrics, and fire drills
- Autonomous peer and outbound-only leaf roles
- Broader detection coverage
- More guided remediation context
- Continued low-overhead fleet hardening
Lessons
What the work clarified
- Security noise is a product-design problem as much as a detection problem.
- Safe defaults should prevent exposure, not merely warn after it happens.
- Small operators benefit from integrated scope when each boundary stays inspectable.