Real-time session monitoring, threat scoring, and automated protection for Linux servers.
Linux kernel 4.15+
# What you're running today
[MONITORING] Datadog / Grafana $15-30/host/mo
[SECURITY] Wazuh / OSSEC free but painful
[PATCHING] Ansible / Puppet free but manual
[ACCESS] Teleport / StrongDM $20-40/host/mo
[FIREWALL] fail2ban free but weak
──────────────────────────────────────────────────────
TOTAL: 4-5 tools, 2-3 vendors $35-70+/host/mo
# With ShellArmor
[ALL] ShellArmor $25/server/mo
──────────────────────────────────────────────────────
TOTAL: 1 agent, 1 dashboard $25/server/mo
Other tools alert you after the damage is done. ShellArmor blocks attacks while they happen.
Every SSH session is captured, scored, and controlled in real time. eBPF hooks capture keystrokes at the kernel level — immune to log tampering. Immutable, hash-chained session recordings for compliance and forensics.
Every PTY keystroke captured via eBPF kprobe
Auth interception — brute force detected before syslog
Cumulative session scoring: warn@40, alert@60, auto-kill@80
Immutable session recordings (hash-chained, tamper-proof)
Live session view from dashboard
Lateral movement chains, reverse shells, privilege escalation, cryptominers, anti-forensics — detected as they happen, not after the damage is done.
Threat scoring examples:
reverse shell → 50 curl|bash → 50 iptables -F → 40
lateral SSH → 25 chmod +s → 25 cat /etc/shadow → 20
SSH-to-SSH lateral movement chain tracking
Binary execution monitoring
File integrity monitoring on critical paths
When a threat is confirmed, ShellArmor acts — not alerts. Sessions are killed, IPs are blocked, file writes are denied at the kernel. All before the attacker finishes typing.
SIGKILL — dangerous sessions terminated instantly
IP BLOCK — auto-block via iptables/nftables with TTL expiry
WRITE DENY — kernel-enforced protection on SSH keys, configs, secrets
HOST ISOLATE — cut network access to compromised hosts
One-click session kill, IP block, user block from dashboard
## attacker session — 10.42.1.7 → prod-db-03
09:14:02 LOGIN user=deploy src=10.42.1.7
09:14:05 +10 Credential access detected
09:14:08 +20 Credential access detected
09:14:11 +25 Key file recon detected
09:14:14 +25 Lateral movement detected
09:14:14 KILL score=80/80 → session terminated
09:14:14 BLOCK 10.42.1.7 blocked for 1 hour
session duration: 12s | damage: none
## real-time session scoring
██ score: 10/80 LOW
███████ score: 30/80 WARN
██████████████ score: 55/80 ALERT
████████████████████ score: 80/80 KILL
■ Session terminated
■ Source IP blocked for 1 hour
■ SSH key file write DENIED
- Record sessions
- Generate audit logs
- Alert after the incident
- Require manual investigation
+ Block attacks live
+ Prevent damage in real time
+ Kill sessions during the attack
+ Respond automatically in milliseconds
| ShellArmor | Teleport | Wazuh | fail2ban | Falco | |
|---|---|---|---|---|---|
| APPROACH & ARCHITECTURE | |||||
| Agent Technology (eBPF / LKM / Proxy) | ✓ eBPF | ~ Proxy | ~ Agent (log-based) | ✗ Log parser | ~ eBPF |
| Install time | ✓ 30 seconds | ✗ Hours | ✗ Hours | ~ Minutes | ~ Minutes |
| Replaces SSH? | ✓ No | ✗ Yes (proxy) | ✓ No | ✓ No | ✓ No |
| Agent footprint | ✓ < 20MB RSS | ✗ Heavy | ~ Moderate | ✓ Light | ~ Moderate |
| LKM / Kernel module required? | ✓ No | ✓ No | ✓ No | ✓ No | ✓ No |
| PAM & AUTHENTICATION | |||||
| PAM auth interception | ✓ In-kernel | ✗ | ~ Log-based | ✗ Log-based | ~ Partial |
| SSO / IdP (Okta / Entra ID / Google) | ✓ | ✓ | ✗ | ✗ | ✗ |
| MFA / TOTP (2FA) | ✓ | ✓ | ✗ | ✗ | ✗ |
| Brute force detection (PAM hook) | ✓ | ✗ | ✓ Log rules | ~ Log-based | ✗ |
| Auto IP blocking (iptables / nftables) | ✓ | ✗ | ✓ Active response | ✓ | ✗ |
| One-click IP/user/session block | ✓ | ✗ | ✗ | ✗ | ✗ |
| Block TTL + auto-expiry | ✓ | ✗ | ~ Basic | ~ Basic | ✗ |
| IP allowlist | ✓ | ✗ | ✗ | ~ | ✗ |
| Tamper detection (rule re-apply) | ✓ | ✗ | ~ Log rules | ✗ | ✗ |
| SSH CA certificate mode | ✓ | ✓ | ✗ | ✗ | ✗ |
| PasswordAuthentication disable | ✓ | ✓ | ✗ | ✗ | ✗ |
| FIM & MAC (FILE INTEGRITY / MANDATORY ACCESS CONTROL) | |||||
| SSH key file protection (LSM) | ✓ Kernel-enforced | ✗ | ~ Alert only | ✗ | ✗ |
| authorized_keys MAC enforcement | ✓ Kernel-enforced | ✗ | ✗ | ✗ | ✗ |
| sshd_config protection | ✓ | ✗ | ~ Alert only | ✗ | ✗ |
| Host key protection | ✓ | ✗ | ~ Alert only | ✗ | ✗ |
| Custom path FIM + MAC | ✓ | ✗ | ✓ FIM only | ✗ | ✗ |
| Agent self-protection | ✓ | ✗ | ~ Basic | ✗ | ✗ |
| SESSION MONITORING (PTY / TTY) | |||||
| PTY keystroke capture (eBPF kprobe) | ✓ In-kernel | ✓ Via proxy | ✗ | ✗ | ~ Syscall |
| Live session monitoring | ✓ Real-time | ✓ Via proxy | ✗ | ✗ | ✗ |
| execve() syscall monitoring | ✓ | ✗ | ~ Via auditd | ✗ | ✓ |
| UEBA behavioral scoring | ✓ | ✗ | ✗ | ✗ | ✗ |
| Cumulative session scoring | ✓ | ✗ | ✗ | ✗ | ✗ |
| Command deny-list | ✓ | ✗ | ✗ | ✗ | ✗ |
| Auto SIGKILL at threat threshold | ✓ | ✗ | ✗ | ✗ | ✗ |
| One-click session kill | ✓ | ✗ | ✗ | ✗ | ✗ |
| Session recording (hash-chained / immutable) | ✓ Immutable | ✓ | ✗ | ✗ | ✗ |
| THREAT DETECTION | |||||
| Lateral movement (SSH-to-SSH pivot) | ✓ | ✗ | ~ Log correlation | ✗ | ~ Syscall |
| Multi-hop chain tracking | ✓ | ✗ | ✗ | ✗ | ✗ |
| Attack path visualization | ✓ | ✗ | ✗ | ✗ | ✗ |
| Reverse shell (netcat / socat / /dev/tcp) | ✓ | ✗ | ~ Rule-based | ✗ | ~ |
| Cryptominer detection | ✓ | ✗ | ~ Rule-based | ✗ | ~ |
| Privesc detection (sudo / SUID / capability) | ✓ | ✗ | ~ Log rules | ✗ | ~ |
| Anti-forensics (history wipe / log tamper) | ✓ | ✗ | ~ Log rules | ✗ | ✗ |
| Honeypot mode | ✓ | ✗ | ✗ | ✗ | ✗ |
| AI / ML command scoring | ✓ | ✗ | ✗ | ✗ | ✗ |
| SSH KEY LIFECYCLE (RSA / Ed25519 / ECDSA) | |||||
| Centralized key inventory | ✓ | ✓ CA-based | ✗ | ✗ | ✗ |
| Fleet-wide key deployment | ✓ | ✓ CA certs | ✗ | ✗ | ✗ |
| Key TTL / certificate expiry | ✓ | ✓ | ✗ | ✗ | ✗ |
| Key drift detection | ✓ | ✗ | ✗ | ✗ | ✗ |
| Weak key detection (RSA <2048 / DSA) | ✓ | ✗ | ✗ | ✗ | ✗ |
| Stale/duplicate key detection | ✓ | ✗ | ✗ | ✗ | ✗ |
| One-click fleet revocation | ✓ | ✓ | ✗ | ✗ | ✗ |
| Dashboard-only writes (kernel) | ✓ | ✗ | ✗ | ✗ | ✗ |
| SSH CONFIG (sshd_config / HARDENING) | |||||
| CIS benchmark hardening (sshd_config) | ✓ | ✓ Proxy-based | ✓ SCA module | ✗ | ✗ |
| Config templates + versioning | ✓ | ✗ | ✗ | ✗ | ✗ |
| Preview before deploy | ✓ | ✗ | ✗ | ✗ | ✗ |
| Config history + rollback | ✓ | ✗ | ✗ | ✗ | ✗ |
| Scope picker (project/group/host) | ✓ | ✗ | ✗ | ✗ | ✗ |
| POLICY ENGINE | |||||
| SOAR detection / response rules | ✓ | ✗ | ✓ Active response | ~ Basic | ✓ |
| Custom scoring policies | ✓ | ✗ | ~ XML rules | ✗ | ✓ |
| Policy templates (prod/staging) | ✓ | ✗ | ✗ | ✗ | ✗ |
| Policy versioning + rollback | ✓ | ✗ | ✗ | ✗ | ✗ |
| Scope-based policy assignment | ✓ | ✗ | ✗ | ✗ | ✗ |
| FLEET MANAGEMENT | |||||
| Host inventory + auto-discovery | ✓ | ✓ | ✓ | ✗ | ✗ |
| Fleet health (/proc metrics) | ✓ | ✗ | ~ Via SCA | ✗ | ✗ |
| Service monitoring (systemd / process) | ✓ | ✗ | ~ Log-based | ✗ | ✗ |
| Service down alerts | ✓ | ✗ | ~ Log-based | ✗ | ✗ |
| Egress connection monitoring (netstat) | ✓ | ✗ | ✗ | ✗ | ~ |
| Egress firewall (iptables OUTPUT) | ✓ | ✗ | ✗ | ✗ | ✗ |
| Container support (Docker / K8s / LXC) | ✓ | ✓ | ✓ Docker listener | ✗ | ✓ |
| Projects & groups (Kanban) | ✓ | ✗ | ~ Agent groups | ✗ | ✗ |
| USER MANAGEMENT | |||||
| User audit (host users) | ✓ | ✓ | ~ Log-based | ✗ | ✗ |
| Offboarding automation | ✓ | ✓ | ✗ | ✗ | ✗ |
| DASHBOARD & TEAM | |||||
| SOC dashboard | ✓ | ✓ | ✓ Kibana | ✗ | ~ Basic |
| RBAC (4 roles) | ✓ | ✓ | ~ Basic | ✗ | ✗ |
| Multi-tenant | ✓ | ✓ | ~ Basic | ✗ | ✗ |
| Audit trail | ✓ | ✓ | ✓ | ✗ | ✗ |
| REST API | ✓ | ✓ | ✓ | ✗ | ✗ |
| Mobile app | ✓ | ✗ | ✗ | ✗ | ✗ |
| INTEGRATIONS | |||||
| Slack / PagerDuty / Webhook | ✓ | ✓ | ✓ | ✗ | ✓ |
| Syslog forwarding | ✓ | ✓ | ✓ | ✗ | ✓ |
| SIEM / SOAR event forwarding | ✓ | ✓ | ✓ | ✗ | ✓ |
| Email alerting | ✓ | ✓ | ✓ | ✗ | ✗ |
| COMPLIANCE & AUDIT | |||||
| CIS hardening score | ✓ | ✗ | ✓ SCA | ✗ | ✗ |
| FIM (file integrity monitoring) | ✓ | ✗ | ✓ | ✗ | ✗ |
| Immutable audit log | ✓ Hash-chained | ✗ | ~ | ✗ | ✗ |
| One-click compliance reports | ✓ | ~ Manual | ~ Dashboards | ✗ | ✗ |
| SOC 2 (CC6.1, CC6.2) | ✓ | ~ | ~ | ✗ | ✗ |
| PCI-DSS (Requirement 10) | ✓ | ~ | ✓ | ✗ | ✗ |
| HIPAA (§164.312 audit controls) | ✓ | ✗ | ~ | ✗ | ✗ |
| FedRAMP (AU-2/AU-3) | ✓ | ✗ | ~ | ✗ | ✗ |
| ISO 27001 (A.12.4) | ✓ | ✗ | ~ | ✗ | ✗ |
| Session audit log (tamper-proof) | ✓ | ✓ | ✗ | ✗ | ✗ |
| INCIDENT RESPONSE (add-on) | |||||
| Incident management workflows | ✓ | ✗ | ~ Active response | ✗ | ✗ |
| Host isolation | ✓ | ✗ | ✗ | ✗ | ✗ |
| Process tree / network connections | ✓ | ✗ | ✗ | ✗ | ✗ |
| PRICING | |||||
| Free tier | ✓ $0 (1 host) | ✗ | ✓ Free (OSS) | ✓ Free | ✓ Free |
| Pro pricing | ✓ $25/server/mo | ✗ $20-40/host/mo | ✓ Free (self-host) | ✓ Free | ~ Free |
| Enterprise pricing | ✓ Contact sales | ✗ Custom | ~ Wazuh Cloud | N/A | ✗ Custom |
| Volume discounts | ✓ 20-40% | ~ | ~ | N/A | ~ |
Teleport + Datadog + StrongDM: $12,000-22,000/month
ShellArmor Pro: $2,000/month
Annual savings: $120,000 - $240,000
vs Teleport
Teleport replaces your SSH with a proxy. ShellArmor protects the SSH you already run. No proxy, no CA, no workflow changes. Install the agent, keep using ssh user@host. Teleport gives access control; ShellArmor gives real-time threat detection, behavioral scoring, automatic session kill, and kernel-enforced file protection — things a proxy can't do.
vs Wazuh
Wazuh monitors logs and alerts after the fact. ShellArmor intercepts in-kernel — PTY keystrokes, session scoring, automatic SIGKILL, kernel-enforced file protection. Wazuh tells you something happened; ShellArmor stops it from happening. Purpose-built for the SSH attack lifecycle with real-time response, not post-hoc log analysis.
vs fail2ban
fail2ban parses syslog after the fact — an attacker who clears /var/log/auth.log is invisible. ShellArmor hooks pam_authenticate() in-kernel, immune to log tampering. fail2ban blocks IPs; ShellArmor blocks IPs, scores sessions, kills PTYs, detects lateral movement, protects key files at kernel level, and feeds everything to a SOC dashboard.
vs Falco
Falco detects. ShellArmor detects AND responds. Cumulative scoring triggers automatic session kill and IP block within seconds. Built-in behavioral engine — works out of the box, no configuration required.