Skip to main content

Runtime monitoring

No matter how well you catch vulnerabilities, actual breaches happen on the running server. Where security analysis finds vulnerabilities in "code/images/services," runtime monitoring shows what is happening right now on the running server and alerts on abnormal behavior immediately. You start by installing a collector in the Server / Host service.

  • Analysis : Monitoring runtime security events on running servers
  • What you need : Host registration plus runtime collector installation
  • Results : Event timeline / aggregation, plus alerts on important events

Event-based collection​

Runtime event collection uses a lightweight runtime collector. Vulinder does not keep a separate metrics collector resident at all times; it receives only detected events centrally.

Why there is no "online/offline" concept

Because metrics are not collected continuously and only events are received, the online/offline status of a server is not shown. An event is recorded when it arrives.

Installing the collector​

  1. The target server must be registered as a Server / Host.
  2. In the service sidebar, open [Settings] > Analyses, turn on Runtime threat detection and click Save.
    • If you chose runtime threat detection in step 2 of the registration wizard, it is already on.
  3. In the Runtime collector card on the same screen, click Install collector and choose a method.
    • Remote auto install : Installs automatically on the server using the registered SSH access details.
    • Manual install guide : Run the displayed commands on the server yourself.
  4. Once installation finishes, events begin relaying to the center.

To remove the collector, click Remove collector on the same card.

Before the collector is installed

Until any event has been received, the runtime screens show the notice "The runtime security collector is not installed" and a Runtime Security install guide button.

How it works​

  • The collector on the server detects runtime events.
  • Detected events are delivered to the center via authenticated requests.
  • The center stores the events and raises alerts according to rules.

Rule management​

Manage rules under Runtime security > Runtime rules in the sidebar. Browse runtime rules and apply them per server to adjust which behaviors are treated as events.

Viewing events and alerts​

View events under Runtime security > Runtime events in the sidebar. The menu group is hidden when runtime threat detection is off.

  • Browse received events newest first and filter them by severity. The breakdown by severity is shown in Runtime threat distribution on the service [Dashboard].
  • Check the details of an individual event. You can see which server it came from and which rule fired.
  • The event list reloads the latest events about every 12 seconds. Auto-refresh pauses while you are loading and browsing older events.
  • The runtime threat feed on the service [Dashboard] reflects new events as soon as they arrive.
  • Receive alerts for important events. Manage channels and minimum severity in Notification settings.
Correlating analysis and runtime

Viewing runtime events alongside security analysis results lets you judge more accurately whether "a vulnerable component is actually being exploited."