Security monitor & threat detection

The security monitor is the situational picture of your system: security alerts by severity, real-time resource usage (CPU, RAM, network, disk) and detected anomalies.

What the monitor shows

• Security alerts: critical/high/medium/low — with an acknowledgment workflow
• Resources: live usage per service and for the whole system
• Anomaly detection: unusual behaviour is flagged and correlated
• Event log: hash-chained audit log (tamper-proof)

The security architecture

• Platform: AppArmor, Docker isolation, read-only root filesystem
• Data: AES-256-GCM for secrets, encrypted storage
• Network: domain whitelist, IP access control, sandbox