Runtime monitoring
No matter how well you catch vulnerabilities, actual breaches happen on the running server. Where security analysis finds vulnerabilities in "code/images/services," runtime monitoring shows what is happening right now on the running server and alerts on abnormal behavior immediately. You start by installing a collector in the Server / Host service.
Event-based collection
Runtime event collection uses a lightweight runtime collector. Vulinder does not keep a separate metrics collector resident at all times; it receives only detected events centrally.
Because metrics are not collected continuously and only events are received, the online/offline status of a server is not shown. An event is recorded when it arrives.
Installing the collector
- The target server must be registered as a Server / Host. Installation uses the registered SSH access details.
- Under the Collector item for that host, Install the runtime collector.
- Once installation finishes, events begin relaying to the center.
How it works
- The collector on the server detects runtime events.
- Detected events are delivered to the center via authenticated requests.
- The center stores the events and raises alerts according to rules.
Rule management
Browse runtime rules and apply them per server to adjust which behaviors are treated as events.
Viewing events and alerts
- Browse received events chronologically, and use the aggregation view to see which types are most common.
- Check the details of an individual event (which server it came from, which rule fired).
- New events are reflected on screen in real time.
- Receive alerts for important events. Manage channels and severity criteria in Notification channels.
Viewing runtime events alongside security analysis results lets you judge more accurately whether "a vulnerable component is actually being exploited."