Detection, containment, compliance and managed response — from kernel-level event collection to SIEM integration and host isolation. Every feature is designed for Linux server and container environments.
Every process execution and file operation on your Linux hosts is observed at kernel level via eBPF tracepoints. RuntimeGuard sees everything — no blind spots, no polling delays, no missed events.
Unlike inotify-based tools that only watch configured directories, eBPF sees activity across the entire filesystem, regardless of path — catching ransomware that operates outside expected locations.
RuntimeGuard doesn't match malware signatures — it watches what processes do. Ransomware has consistent behavioural fingerprints: it writes many files rapidly, then renames them with new extensions.
Detection rules run against a 60-second sliding time window. When a process crosses a threshold, an incident is created immediately — before encryption completes.
The moment a detection rule fires, RuntimeGuard creates an incident and sends alerts through your configured channels. No polling lag — alerts fire as soon as the incident is created.
Every incident is stored with a complete timeline of events: which process triggered it, which files were involved, when activity started and when it cleared.
Timelines give your team everything needed to investigate what happened, understand the scope, and respond — without digging through raw logs.
When a high-confidence detection fires, RuntimeGuard can automatically send a kill signal to the offending process — stopping encryption mid-flight before more files are affected.
Containment is configurable: choose automatic kill, alert-only, or manual confirmation. Containment actions are logged with full audit trails.
Fixed thresholds work for generic attack patterns. But every host has different normal behaviour — a file server writes thousands of files per minute; a web server almost none. RuntimeGuard learns what's normal for each host individually and flags deviations automatically.
Statistical baselines are built per host using Welford's online algorithm. After a short warmup period, any event rate more than 3 standard deviations above the historical average triggers an anomaly incident — even if it falls below the fixed rule threshold.
A file server has a very different threat profile than a web server or a build agent. RuntimeGuard lets you configure detection thresholds per host — so each machine is evaluated against rules that match its actual workload.
Host-specific overrides take priority over tenant-wide defaults. Overrides can be set and reset from the dashboard without editing configuration files or restarting the agent.
Security tools that cry wolf get ignored. RuntimeGuard gives you direct controls to reduce noise without turning off protection — maintenance windows, per-host tuning, and baseline resets.
RuntimeGuard detects container escape techniques at the syscall level — where no container runtime or Kubernetes admission controller can intercept them. Two dedicated rules cover the two primary escape syscalls: unshare() and setns().
Every process execution event is enriched with container context — container ID, pod name, and namespace — so incidents are immediately scoped to the right workload.
RuntimeGuard sends incidents to your existing security toolchain the moment they are created — no polling, no manual export. Configure one or more destinations per tenant via the dashboard or API.
RuntimeGuard maps its detection coverage to SOC2 and CIS Benchmark controls and generates a report on demand. The report shows which controls are covered by active detection rules and which incidents are relevant per control.
Pull raw events and incidents into any SIEM or data pipeline using the export API. Three output formats and a real-time server-sent events stream for live ingestion.
RuntimeGuard includes a full analyst workflow layer for teams that triage incidents internally or operate a managed detection and response service. Every incident can be tracked through its full lifecycle.
Every detection rule ships with a MITRE ATT&CK-mapped response playbook. When an incident fires, the analyst gets structured response steps tailored to that specific technique — no generic runbooks.
Host isolation blocks all network traffic at the iptables level via a dedicated RUNTIMEGUARD chain, while keeping the agent's connection to the backend open so the host remains under observation.
RuntimeGuard enriches every detection with multiple threat intelligence sources — automatically, without any extra configuration for the free tier. Optional API keys unlock deeper coverage from VirusTotal and AlienVault OTX.
IP reputation and hash checks run inline during event ingest. When a match is found, an incident is opened immediately — before a rule threshold would have been reached.
title: Bash execution from /tmp name: bash_from_tmp logsource: category: process_creation product: linux detection: selection: exe|contains: - /tmp/ - /dev/shm/ comm: bash condition: selection level: high
|contains, |startswith, |endswith, |re (regex), and exact match.selection and not filter to exclude known-good processes, or 1 of them for multi-selection rules./etc/ flags all writes under that directory — not just a specific file.file_write, file_rename, file_delete and file_chmod — covers the full attack surface of file-based persistence and anti-forensics./etc/ld.so.preload — the primary mechanism for LD_PRELOAD-based userland rootkits that intercept every libc call on the system./proc/modules at agent start and alerts on newly loaded kernel modules with known-bad names (diamorphine, reptile, suterusu, kovid, and others)./proc/PID/exe resolves to a deleted path. Indicates fileless malware or binary replacement by a kernel rootkit attempting to erase its on-disk footprint.securityContext.privileged: true — grants full access to the host kernel, equivalent to running as root on the node.SYS_ADMIN, NET_ADMIN, SYS_PTRACE, SYS_MODULE or ALL to their capability set.gcr.io/myproject) are admitted.apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: name: runtimeguard webhooks: - name: admission.runtimeguard.io clientConfig: url: https://api.runtimeguard.io/v1/k8s/admission?key=YOUR_API_KEY rules: - operations: [CREATE, UPDATE] resources: [pods]
Data exfiltration over DNS is the covert channel of choice for advanced persistent threats — it bypasses firewalls, passes through most enterprise filters, and is invisible to connection-based monitoring. RuntimeGuard captures raw DNS traffic at the kernel level using an AF_PACKET raw socket and analyses every query for exfiltration patterns.
Shannon entropy analysis runs on every DNS subdomain. Normal hostnames have predictable, low entropy. Base64-encoded or hex-encoded payloads pushed through DNS tunnels produce high-entropy subdomains that stand out immediately.
RuntimeGuard's Business tier is built for managed service providers who protect multiple customer environments. From a single login, manage any number of customer tenants — each with full data isolation, its own API keys, hosts, incidents and alerting configuration.
The MSP portal gives you a unified view across all customers with a cross-tenant SOC feed, per-tenant drill-down, and bulk management tooling — without sharing credentials or mixing customer data.
RuntimeGuard supports single sign-on via Google and Microsoft OIDC, letting enterprise teams use their existing identity provider without managing separate credentials. SSO authentication is available in addition to API-key authentication — each method is independently controlled per tenant.
Deploy RuntimeGuard on your Linux servers and start detecting threats in minutes.