We build the smallest possible sensor.

securityagent started as an internal tool: we were tired of monitoring stacks that needed their own monitoring. A brute-force detector should not be the reason a box falls over.

So the agent is a handful of POSIX shell scripts driven by inotify — event-driven, no polling loops — and boxed in by systemd to 10% of one core and 100 MB of RAM. It reads auth.log, samples /proc, and ships a single JSON payload. Nothing else.

The console is deliberately server-rendered and dense — a SOC screen, not a marketing dashboard. Everything you see is one heartbeat and one alert stream away from the metal.