The security agent that fights back.
Other tools alert you. Inner Warden detects, scores, and blocks attacks autonomously. 40 eBPF kernel hooks deep in your Linux kernel. Dry-run by default. Open-source, built in Rust.
curl -fsSL https://www.innerwarden.com/install | sudo bashinnerwarden setup- install
- ~10s
- memory
- ~150 MB
- default
- safe
Five stages. Fully automatic.
- SSH brute-force
- Port scan
- Privilege escalation
- Container escape
- Remote control
- 40 kernel monitors
- Network inspection
- Traffic fingerprinting
- Process tracking
- File watching
- 47 cross-layer rules
- Behavior learning
- Attack fingerprint
- Campaign detection
- Confidence score
- 12 AI providers
- Your rules apply
- Optional
- Instant block
- Firewall rule
- Honeypot trap
- Kill process
- Audit trail
Attacks don't wait. Your defense shouldn't either.
SSH brute-force, port scans, web scanners, credential stuffing. Every public server gets hit. Most operators discover this only after something goes wrong.
Inner Warden watches your logs in real time. Every threat gets an AI-scored confidence level. Above your threshold? Firewall rule added. Telegram alert sent.
Dry-run by default. Full audit trail. Every decision logged. Approve or deny actions from Telegram. Go live only when you trust the decisions.
It's 2 AM. Someone brute-forces your SSH. You're asleep.
Here's what Inner Warden does while you sleep.
Threat contained. 4 seconds.
8 failed SSH logins in 300 seconds from 203.0.113.42. Inner Warden catches the pattern, AI confirms brute-force with 0.90 confidence. Firewall deny rule added via ufw. Your phone buzzes with the Telegram alert.
Honeypot traps the attacker.
A different IP tries the same trick. This time they hit the honeypot. Fake SSH session, real capture. Every credential and command logged. Session ends, IP blocked, transcript saved.
Session ended. IP blocked. Full transcript logged.
Other tools just alert you. Inner Warden stops threats before they execute.
Inner Warden runs deep inside your Linux kernel. It monitors every process, every connection, and every command. When an attacker tries to get in, the attack is blocked before it can do any damage. No delay. No way around it.
Monitors 40 critical system operations. When something suspicious happens, the attack is stopped before it can cause harm. No waiting, no manual intervention.
Tracks 7 common attack sequences: reverse shells, code injection, privilege escalation, and more. The attacker never gets a foothold on your server.
Blocks malicious scripts from running in temporary directories. Uses the same security framework trusted by enterprise Linux distributions. Safe by default.
Known attackers are blocked at the network level before they can even reach your server. Handles millions of packets per second with near-zero CPU impact.
Knows the difference between normal system activity and real threats. 137 safe processes are recognized automatically. You only get alerted when it actually matters.
Behavioral DNA fingerprinting identifies the same attacker even when they switch VPNs or Tor nodes. Risk scores and detector knowledge transfer automatically to the new IP.
Start safe. Scale up when ready.
Every feature is off by default. Enable what you need, when you need it.
- SSH brute-force detection
- Credential stuffing detection
- Real-time monitoring
- Full audit trail
- Telegram notifications
- Dry-run mode by default
- Auto-block malicious IPs
- AI-powered confidence scoring
- Actions require your approval
- Cloudflare WAF integration
- AbuseIPDB reporting
- nginx rate limiting
- Cross-IP attacker tracking (DNA)
- Neural anomaly detection (daily retrain)
- 47 cross-layer correlation rules
- SSH honeypot trap
- AI command validation for agents
- DDoS shield with adaptive rate limiting
innerwarden system scanScans your server, detects what's running (SSH, Docker, nginx, Suricata, osquery...), and tells you exactly what to enable.
What if it makes a mistake?
Designed for regulated environments.
Inner Warden ships with the controls auditors look for. Hash-chained audit trails, admin action logging, session management, configurable retention, and GDPR data subject commands. Everything included, Apache-2.0 licensed. Built in from day one.
Designed to meet ISO 27001 Annex A controls (A.9, A.10, A.12, A.16, A.18). Read the full privacy and data protection documentation.
Yes, it's curl | bash. Here's what it does.
curl -fsSL https://www.innerwarden.com/install | sudo bash- Downloads a single SHA-256 verified binary (~7 MB) to /usr/local/bin
- Creates a dedicated service user with minimal permissions
- Starts sensor + agent via systemd (Linux) or launchd (macOS)
- Begins in dry-run mode. No firewall changes until you say so.
Want to read the script first? innerwarden.com/install
Talk to your server on Telegram.
Real-time alerts, approve/deny actions, and a conversational bot that answers questions about your server's security.
/status/threats/decisions/blocked/doctor/guard/watch/askinnerwarden config telegramInteractive wizard. Bot token and chat ID via prompts.
Attack one node. Protect them all.
Inner Warden nodes form a mesh network. When one detects a threat, all others block the attacker automatically. Like birds that fly when one hears danger.
Every threat signal is cryptographically signed. Tampered signals are rejected instantly.
Tit-for-tat reputation. New peers start skeptical. Trust grows with confirmed signals, drops with false ones. 3:1 asymmetry.
No signal causes permanent action. Everything is scored and staged. Blocks auto-revert if not confirmed locally.
New nodes start at trust 0.1. Rate-limited to 50 signals/hour. Malicious nodes get quarantined automatically.
innerwarden config mesh enableinnerwarden config mesh add-peer https://peer-server:8790That's it. Identity generated automatically. Peers discovered via ping. Trust builds over time as signals get confirmed.
Not another alert tool.
| Inner Warden | Falco | Wazuh | CrowdSec | |
|---|---|---|---|---|
| Kernel-level detection (eBPF) | 40 hooks | Rules-based | No | No |
| Autonomous response | 20 playbooks | Alert only | Limited | IP only |
| AI-powered triage | 12 providers | No | No | No |
| Behavioral DNA fingerprinting | Cross-IP tracking | No | No | No |
| Mesh collaborative defense | Ed25519 signed | No | No | Community lists |
| AI agent protection | 71 rules | No | No | No |
| Dry-run by default | Yes | N/A | Yes | Yes |
| Memory footprint | ~150 MB | ~60 MB | ~500 MB+ | ~50 MB |
| License | Apache-2.0 | Apache-2.0 | GPL | AGPL |
Why I built this.
Every security tool I tried either just alerted me (Falco), required a massive stack to do anything useful (Wazuh + ELK + SIEM), or couldn't act autonomously when it mattered most — at 2 AM when I was asleep.
I wanted something that could detect a reverse shell at the kernel level, block the attacker, deploy a honeypot to capture their tools, and alert me on Telegram — all in under 5 seconds, with zero external dependencies.
So I built it. Solo developer. 37 releases. Apache-2.0 licensed. Running in production on my own servers, blocking real attacks every day.
If this project helps protect your servers, give it a star so others can find it.
Your server should defend itself. Let it.
40 kernel hooks. 49 detectors. 47 correlation rules. Cross-IP attacker tracking. Neural anomaly detection with daily retrain. Install in 10 seconds. Dry-run by default.