Introduction

Ferro Sentry is an ultralight, open-source security agent written in Rust. It provides Endpoint Detection and Response (EDR) alongside continuous posture auditing for Linux and Windows servers, streaming events via gRPC.

Why Ferro Sentry?

Traditional EDR software requires heavy system agents that consume gigabytes of RAM and heavy CPU. Ferro Sentry is compiled to a static Rust binary (~2 MB) with less than 0.1% CPU overhead, ensuring active threat detection without sacrificing VPS performance.

Core Modules & Status

Ferro Sentry provides two main categories of modules:

✅ Currently Available

• Port & Listener Auditor — Active SYN & TCP scanning of local interfaces, open ports, and database exposures (MongoDB, Redis, Elasticsearch).
• Posture & Vulnerability Scanner — Active auditing for SSH settings (PermitRootLogin, PasswordAuth), SUID/SGID suspicious binary permissions, and basic CVE exposures.
• gRPC Event Engine — Deduplication, severity scoring, rate-limiting, and local gRPC tunnel multiplexing with Nexus Agent on port 4317.

🚧 In Development / Roadmap

• Process Sentinel (EDR) — Process execution tracking, shell children, `/tmp` launches, hidden PIDs, and memory injection alerts.
• File Integrity Monitor (FIM) — Real-time inotify file modification alerts for system files (`/etc/passwd`, binaries) with SHA-256 baseline snapshots.
• Auth Guard & Log Watcher — Real-time system log tailing (`auth.log`, `journald`, EventLog) and SSH brute-force detection.
• Persistence Hunter & YARA Scanner — Cron job audit, systemd service tampering, and YARA signature scanning.

Licensing

Licensed under Apache 2.0 / MIT. You can use it commercially, customize rule files, and extend it freely.

Next steps