Keystone packs
18 packs in the public catalog. Customers sign in to download them.
18 packs
- Cloud account security baseline Compliance checks for AWS accounts and Azure subscriptions: the cloud module (aws_collect and azure_collect, run on a queue worker with vault-referenced credentials), the cloud-facts table type, and 17 checks over root and IAM credentials, CloudTrail, S3 public access, security groups and NSGs…
- Container and Kubernetes monitoring Monitoring for containerized workloads: the containers-agent module (Docker and Podman hosts, through their Keystone agent: per-container state, CPU, memory against its limit, traffic, restarts and uptime) and the kubernetes module (a cluster through its API server from a queue worker, with a…
- File baseline The files and folders every host must have, as compliance checks: the file-state and file-keys table types, the Linux and Windows agent modules' collect_file_state collector and path_ensure fix, and two example baselines — each one list of paths that installs as one check per path, mapped to…
- Fleet monitoring Host monitoring out of the box: the Linux, Windows and macOS agent modules, whose System metrics function files CPU, memory, swap, disk and uptime (and load, on Linux and macOS) under the same series names; a Fleet health dashboard over them, deployed as an organization board on install; and…
- Linux patching Linux patch channels as a rollout kind: repository file templates and baselines that hold each ring of hosts to its mirror snapshot, patch-state checks that say whether a host has caught up, the Linux agent module, and the workflows that patch one host or a whole ring.
- Linux security baseline Compliance checks for Linux hosts: the Linux agent module's fact collector and OpenSCAP import, the host-facts and scap-results table types, 21 checks over SSH, accounts, sudo, auditd, packages, kernel settings and patching mapped to NIST SP 800-53 (and to Truestone catalogue topics, as…
- NetFlow, IPFIX and sFlow adapter (goflow2 and Vector) Network flows into Keystone as per-minute metrics, never as raw flows: goflow2 near the exporters decodes NetFlow v5/v9, IPFIX and sFlow, and Vector sums them per minute for each talker, keeps those over a floor and posts them to a netflow event source, which writes netflow.bytes and…
- Network device monitoring (SNMP) SNMP polling from a queue worker: the snmp module (v1, v2c and v3 with AES; device uptime, per-interface traffic, errors, discards, status and speed, and CPU and memory where the device implements HOST-RESOURCES-MIB); a Network devices dashboard, deployed as an organization board on install; and…
- Network device security baseline Compliance checks for routers and switches: the network-cli module, which reads a Cisco IOS/IOS-XE or Juniper Junos configuration over the device's SSH system connection from a queue worker, the host-facts table type, and 11 checks over password storage, AAA, SSH and telnet, HTTP, remote…
- OTLP over gRPC adapter (OpenTelemetry Collector) OpenTelemetry metrics over gRPC into Keystone without HTTP/2 on the server: a Collector near the senders receives OTLP on gRPC 4317 and forwards it over OTLP/HTTP to the otlp event source.
- Process and service monitoring Per-process and per-service monitoring for Linux, Windows and macOS agents: the process_metrics function of the host modules (watched processes and the busiest few by CPU and memory, per process name; watched services on Linux and Windows); a Processes and services dashboard; four alert rules…
- SNMP trap listener (on an agent) SNMP traps received by a Keystone agent near the devices, with no relay to install: the snmp-trap-listener module (v1, v2c and v3 with AES; communities and v3 passwords as secret references) runs as a service the agent supervises on UDP 162, and sends each accepted trap to an event source of…
- SQL database connector A data source connector for SQL databases (PostgreSQL, MySQL or MariaDB, SQL Server), run on a queue worker inside the database's network. Install it, then add a data source of kind Connector module naming it: workflows read the named queries you configure and write the tables you list.
- Security monitoring Exposure out of the box: TLS discovery with its endpoints and every certificate they present tracked — key and signature algorithms, hybrid and post-quantum included, and which are quantum-vulnerable — a Linux package inventory, a daily workflow that checks the inventory against OSV.dev and…
- Service monitoring Applications and business signals out of the box: HTTP and API checks (up, status, latency, TLS days left) and numbers read from any JSON API, from a queue worker; failed logins, lockouts and new admins from Linux and Windows hosts; and heartbeats from backups and batch jobs through a small…
- Syslog adapter (Vector) Syslog into Keystone without a listener on the server: Vector near the senders keeps the lines worth an event (authentication failures, interface changes, configuration changes, critical severities), classifies them and posts them to a syslog event source.
- Syslog listener (on an agent) Syslog received by a Keystone agent near the senders, with no adapter to install: the syslog-listener module (UDP 514) and the syslog-tcp-listener module (TCP 6514, with TLS and optional client certificates) run as services the agent supervises, keep only the lines worth an event —…
- Windows security baseline Compliance checks for Windows hosts: the Windows agent module's fact collector, the host-facts table type, and 14 checks over the account and lockout policy, the Guest account, the audit policy, the firewall, SMB, BitLocker, Defender and pending reboots, mapped to NIST SP 800-53 (and to…
No packs match . Show all packs