Cyber Defence Center
A problem becomes a Service Desk ticket, and the state of a system follows its record in the CMDB.
Cyber Defence CenterAdvanced System Monitoring
Hosts, services, network devices and applications, checked with or without an agent, and without a borrowed engine underneath.
What it does
Knows the difference between down and unreachable
Monitoring is trusted only as long as its alerts are true. Eagle MonV opens a problem when a check fails, closes it when the check recovers, and takes care not to cry wolf in between.
- Availability. Ping, TCP, HTTP with the response time broken into its parts, DNS answers, and the TLS certificate with its chain and expiry.
- Server health, agentless. Windows over WinRM and Linux over SSH, with pinned keys: processor, memory, disks, services, errors in the event log or the journal, pending restarts and backups.
- An agent where a login cannot reach. For hosts that cannot be reached from the monitoring server: the same fixed questions, and no command channel.
- Read-only by contract. Collectors run a published, fixed list of commands and nothing else, and a test enforces it.
- Network devices. Switches, routers and firewalls over SNMP v2c and v3: interfaces, traffic, errors, processor and memory. It reads, and never writes.
- Proxmox VE, the whole cluster. One check reads quorum, nodes, storage, disk health, backups, high availability and Ceph, through a read-only token.
- Databases and web servers. SQL Server and MariaDB health, backups and jobs, with read-only credentials; HTTPS redirect and security headers.
- Disks over time. A history for every disk and a forecast of the days until it is full, with a warning at fourteen days and an alarm at three.
- Alerts you can trust. Confirmation before a state changes, hysteresis on limits, flapping detection, and dependency chains so one failed switch is one problem, not forty.
- Maintenance and objectives. Planned windows hold the noise, and quality targets say whether the service met what was promised.
- Told where you are. Notifications by mail and by signed webhook, to whatever you already use for on-call.
In the suite
One of the hub's senses
Eagle Agents
The monitoring agent is MonV's own: read-only, with fixed questions and a key that changes every ninety days.
Eagle AgentsAn open door
A documented API with keys scoped to read, acknowledge or maintain. Another system can open a maintenance window before it starts its own work.
How it is secured
Reads everything, changes nothing
A monitoring system holds a login to every machine it watches. This one is built so that the login is worth as little as possible.
- Least privilege everywhere. Read-only accounts and tokens, and a fixed list of commands. A compromised MonV gets a host's health figures, never its shell.
- Credentials sealed. Every stored credential is encrypted with AES-256-GCM, and the keys and certificates of the hosts it talks to are pinned.
- Authenticator codes and roles. Sign-in with a second factor, and rights by role.
- A Security Log that leaves the building. Shipped over syslog to your SIEM, with the database encrypted at rest.
Good to know
Before you ask
On your premises
Runs on your own Windows Server with IIS and MariaDB, installed from an offline package, with a production and a test instance side by side.
Licensed by what it watches
By the number of monitored addresses, or unlimited.
No borrowed engine
The checks and collectors are its own. There is no third-party monitoring core underneath, and no licence of somebody else's to inherit.
Eagle SecOps Suite
One part of one system
Eagle MonV is part of the Eagle SecOps Suite: governance, detection, monitoring, vulnerability scanning and secure DNS, built by one team to work as one.
See Eagle MonV running
An hour with the people who built it, on a real system, with your questions. No slideware.