Vulnerabilities, firewall and threat response

Where the vulnerability data comes from, what it covers, and what Stasys and you can do about a finding or an attack.

Where the vulnerability data comes from

Stasys's vulnerability data comes from the vulnerability service that comes with your licence. It brings NVD, the CISA list of known exploited vulnerabilities, Debian and Ubuntu security advisories, the Ubuntu security tracker, GitHub advisories and exploit-likelihood scores together in one feed, refreshed every few minutes.

Operating-system packages are matched on your own Stasys server. To check application libraries, services and the kernel, Stasys sends the service each server's name, operating system and that list of software.

Vulnerabilities on what is installed

On Debian and Ubuntu, findings are matched to the exact versions each server has, so every finding is about your machine and not about software you do not run. On RHEL and SUSE, Stasys shows the security fixes waiting; on Windows, the missing updates. On Linux servers, the libraries your applications pin in their lockfiles (npm, Composer, PyPI, RubyGems, Go, Cargo, Maven and NuGet) and WordPress core, plugins and themes are checked too.

Known-exploited issues come first, with the upgrade that closes them. The CVE page ranks what to fix first and gives each finding a fix-by date, and you are told when one is overdue.

When a vulnerability of medium severity or worse has no fix yet, Stasys drafts a temporary mitigation for the servers it affects. Nothing is applied until you press Apply now, and Stasys removes it once the server has the fixed version.

The web firewall

Set a policy once and apply it to every server or a group. Stasys alerts you when a server's rules drift from it.

Stasys only changes a web firewall it set up itself. Where a hosting panel such as Kontrol7, cPanel, Plesk or DirectAdmin, or someone else, runs the firewall, the server shows "Stasys reports only" and is never written to.

Acting from the alert

Block an address, quarantine a file or scan a server straight from the threat feed, and isolate a server with a second person's approval. Every action is recorded.

Stopping an attack on the server

On Linux servers, the agent stops an attack on its own, in seconds, without waiting for the console or the AI. When a program collects secret files and packs or uploads them, leaves a root shell behind, opens a reverse shell, or downloads and runs code under the web server, the agent stops it, blocks where it was sending to for 24 hours, quarantines the files it dropped and removes the root bit from anything it left. Every step is recorded and can be undone from Security → Protection.

Each server learns for 7 days first, recording only what it would have stopped. If one server stops more than 5 attacks in 10 minutes, it switches itself to "Detect only" and opens an incident.

A stopped attack opens one critical incident. Your AI security engineer looks for the same attack on your other servers, works out what leaked, rotates the credentials Stasys owns and drafts the intrusion report. The report counts only once a named person approves it.

Proof, not assumptions

Every week Stasys restores the newest database dump and the largest file from each server's latest backup into a scratch area, checks them, times it and deletes the copy, so "when did you last test that?" has an answer. Where that is not possible, it pulls one file back and marks the result as weak proof. Servers with whole-server backups are also restored in full and booted, with no network, once a week, so you know the server itself comes back.