Open Source · Apache 2.0 / MITby SecuryBlack

Active server defense. Continuous posture audits.

Ferro Sentry is an ultralight security and EDR agent written in Rust. Continuous SSH, port, FIM, and process auditing with near-zero overhead and native gRPC streaming.

Get StartedView on GitHub
Linux
curl -fsSL https://install.ferrosentry.dev | sudo bash

Also available for Windows (PowerShell)

~2 MBbinary size
<0.1%CPU usage
Rustmemory safe
EDR + CSPMunified agent

Capabilities & Roadmap

Active defense & continuous compliance

Review live operational modules alongside upcoming EDR sensors currently under active development.

Available

Port & Listener Auditor

Active SYN/TCP scanner that audits listening interfaces, detects non-standard open ports, and alerts on databases exposed to 0.0.0.0 (MongoDB, Redis, Elasticsearch).

Available

Posture & Vulnerability Scanner

Audits SSH configurations (PermitRootLogin, PasswordAuth), checks SUID/SGID suspicious binary permissions, world-writable files, and kernel CVE exposures.

Available

Ultralight Rust Engine

~2 MB static binary running as a systemd or Windows Service with <0.1% CPU overhead, zero runtime dependencies, and memory safety guaranteed.

Available

gRPC & Nexus Agent Tunnel

Multiplexes posture findings over local gRPC (port 4317) to Nexus Agent, which forwards security envelopes through outbound TLS streams.

In Development

Process Sentinel (EDR)

Real-time monitoring of process spawning, interactive shell children, execution from /tmp, hidden PIDs, and deleted executable binary dangling references.

In Development

File Integrity Monitor (FIM)

Real-time inotify / ReadDirectoryChangesW tracking of critical configuration files (/etc/passwd, /etc/ssh, certs) with SHA-256 baseline snapshots.

Architecture & Flexibility

How it works — your choice of deployment

Integrate Ferro Sentry directly with SecuryBlack Cloud for automated threat posture monitoring, or stream security findings to your own custom OTLP collector.

Your Server

Linux / Windows

Ferro Sentry

EDR & Auditing (Rust)

Nexus Agent

TLS Tunnel Orchestrator

SecuryBlack Cloud

Security Posture Dashboard

Zero BottlenecksDeduplication & rate-limiting prevent security log floods
Offline ResilienceBuffers security findings locally on disk if collectors drop
Unified TelemetryMultiplexed alongside OxiPulse metrics over local gRPC

Installation

Up and running in 60 seconds

One command installs the binary, registers the service, and starts active defense auditing.

1

Install with one command

bash
curl -fsSL https://install.ferrosentry.dev | sudo bash
2

The installer will prompt for your auth token

bash
Enter your Ferro Sentry token: fs_live_xxxxxxxxxxxx
3

Agent starts automatically as a systemd service

bash
● ferrosentry.service - Ferro Sentry EDR & Auditing agent
     Loaded: loaded (/etc/systemd/system/ferrosentry.service)
     Active: active (running)

Need advanced configuration? Full install guide →

Open Source

Built in the open,
transparent threat defense.

Ferro Sentry is an open-source security agent maintained by SecuryBlack. Security through obscurity is dead — we believe host protection code must be public, performant, and auditable.

View source on GitHubOpen Source License

Apache 2.0 / MIT Dual License

Permissive license. Use it in commercial projects, modify rules, distribute it — total transparency.

Custom Security Rules

Write custom detection rules in YAML or YARA signatures. Contribute rules back to the global threat feed.

Self-hostable & Auditable

Run your own gRPC ingested proxy or local JSON logging. Complete control over your security data.

Harden your servers in 60 seconds

One command. Continuous EDR, posture auditing, and active threat prevention across your VPS fleet.

Get Started for freeStar on GitHub

Apache 2.0 / MIT · No credit card · No vendor lock-in