Every scan on this site so far — Regular, Advanced, Exposure — looks at your domain from the outside, the way an attacker would. The Solvbeat Agent is different: it runs on your own server and checks what's actually going on inside it.
Add a server → See pricingNo agent-management console to learn, no complex config file — one command, run once.
From your dashboard, name the server and (optionally) link it to one of your domains.
Copy the one-liner shown and run it with sudo (Linux) or as Administrator (Windows).
This is illustrative — the real command with your actual one-time token is generated when you click "Add server" in the dashboard. Copying this exact line will not work.
The installer sets up a daily scheduled task automatically — nothing to configure or remember.
Findings show up in your dashboard, and in that domain's Advanced/Exposure Scan PDF reports if you linked one. If a new security update comes up pending, you also get an email — not just a dashboard you have to remember to check.
Read-only by default — the agent reports, it doesn't change anything on its own. Includes both static configuration checks and behaviour-based threat hunting against the server's own event log. On request, you can opt in to a small set of fixed, reversible response actions — reviewed by a Solvbeat analyst before anything runs, never automatic.
Flags OS and package updates that haven't been installed yet, before they become the way in.
Root login over SSH, password-only authentication, RDP without Network Level Authentication — the settings that turn a server into an easy target.
Confirms ufw/iptables/firewalld (Linux) or Windows Firewall and Defender are actually switched on, not just installed.
World-writable files in system paths, unusual SUID binaries — the small misconfigurations that add up.
Enabled Guest accounts, an unusually large local Administrators group — access that's easy to forget about.
BitLocker status and whether the obsolete, WannaCry-era SMBv1 protocol is still switched on (Windows).
Scans the last 24h of the local event log for obfuscated/encoded PowerShell commands and suspicious use of mshta, wevtutil or certutil — classic payload-delivery and log-clearing techniques.
Flags a hidden admin account hiding behind the reserved Administrator RID, a burst of failed logons in the last 24h, and any scheduled task registered in that window.
Catches the classic Pass-the-Hash signature (an NTLM network logon to a local admin account) — the textbook sign of stolen-credential lateral movement between servers.
Flags a newly opened listening port since the last check, and a single remote IP holding an unusually high number of active connections (possible scan, flood, or beaconing). Connection metadata only — not full packet inspection (Linux, via ss).
Each of the checks above is backed by a real, published MITRE ATT&CK technique ID and comes with a short response playbook right in your dashboard — what to check first, what to isolate, what to reset. The underlying detection logic for each one is also published as a standard Sigma rule, the same portable format used by Splunk, Elastic, and QRadar.
Out of the box, the agent only ever sends data to Solvbeat — every check it runs is fixed in the script itself. If you want, you can separately opt in (--enable-actions) to let it carry out one of five fixed, reversible responses — block an IP, rate-limit an IP instead of cutting it off entirely, undo a previous block/rate-limit, lock an account, or quarantine a rogue cron task — and only ever the specific one a Solvbeat analyst has reviewed and approved, never a free-text command, never automatic. Nothing changes unless you add that flag yourself. The script (plus the installer) is published for you to read before you run it with elevated privileges. If you want to see exactly what it does before installing anything, the source is right here: agent-linux.sh / agent-windows.ps1.
Log in, add your first server, and it'll report within a day.
Go to Servers →