See suspicious activity. Keep the evidence.
shld watches a Linux server. When activity matches a rule, it writes a finding into a report on that server. An administrator opens the report and investigates.
- 1 · Watch
- A folder you choose. On Linux, also the programs and network connections its account can see.
- 2 · Record
- A finding: a saved note naming the matched rule and linking the observations behind it.
- 3 · Review
- You open the report. shld sends no email, chat or phone notifications yet.
Example: a decoy file and a network connection
A decoy is an empty file you choose to watch. Each card is one running program (Linux calls it a process).
Program 4 holds the decoy open and has a network connection. shld writes a finding: a warning sign, not proof of an attack.
Process 4 has both signs, so shld wrote one finding into the report. Nothing was stopped.
What the finding holds Illustrative
- Rule
canary-egress: both events from one program within 120 seconds. The name does not mean data left.- Program
- One process ID in both events (“process 4”).
- Event 1
- The decoy is held open. shld calls it a canary.
- Event 2
- A TCP connection and its peer. Direction is unknown; in the test, the peer is loopback.
- Also kept
- Times, host name and event IDs, in a local hash chain the agent verifies.
- Not in it
- File contents.
What this example does not prove
- An open file does not prove it was read.
- Backup and inventory tools can open decoys too.
- Activity that starts and ends between checks can be missed.
Today, and not yet
Works today Tested in set scenarios
- Watches files and package lists in the chosen folder.
- Checks exact package versions against a small offline advisory list.
- Records selected program, network, persistence and decoy findings.
- Also shows findings as CLI JSON and on a local API. As a systemd service, they reach its journal.
- Optional collector: another server you run. It keeps copies and reports servers whose heartbeat went stale.
Not built yet
- Planned: deliver a finding or missing-server warning to the right administrator.
- Blocking, clean-up or automatic fixes.
- A hosted service.
- Measured results on production servers.
Until then, decide who opens the report, and how often.
Private administrator trial
shld is a working title, not released. Administrators run it by hand on servers they choose. There is no signup.
These links open only for trial participants with repository access.
- Operator guide (requires repository access): setup and scope.
- Project README (requires repository access): status and limits.
- Example and limits (requires repository access): the test behind Fig 1.
Ground rules
- Start with an ordinary account and a narrow scope.
- Keep the local API on loopback. It has no authentication.
- Treat the evidence as sensitive: it holds host names, paths and endpoints.