All features at a glance
NODE64 collects on your devices, analyses centrally and tells you exactly what to do – from hardening to optimisation.
What NODE64 does for you
Inventory, vulnerabilities, hardening and operating state – evaluated in one place, across every system.
Anomaly detection
Detects ransomware, back doors and break-ins by how behaviour changes — not by whether somebody has seen them before.
Sixteen methods, none of them signature-based: NODE64 learns what this one server normally looks like and reports when it behaves differently. Ransomware by entropy and extension clustering, back doors by code that executes network input, spam senders by their construction, break-ins by new accounts, installed keys, open ports and logins from unfamiliar origins. Because it looks for behaviour rather than known patterns, it also catches a variant that did not exist yesterday.
Best practices & optimisation
Curated recommendations per system – with a ready command instead of general advice.
Curated NODE64 recommendations per system – from hardening to optimisation (e.g. ZFS tuning, Raspberry Pi performance) – each with a ready-to-run command. Growing continuously.
Security & hardening
Spot misconfigurations before they are exploited.
Checks your systems against hardening best practices – open ports, insecure services, permissions and configurations.
CVE matching
Known vulnerabilities in your own package set, with CVSS and fix version.
Continuously matches installed packages and versions against the latest CVE feeds – and also checks whether your packages and Docker containers are up to date (and why an update matters).
Alerting
Rule-based notifications – globally or per device and group.
Notifications via email and webhook on critical events. Higher tiers: shorter check intervals.
Telemetry & health
Operating state per host, as a trend rather than a snapshot.
CPU, load, memory and uptime per device over time – so a finding can be placed in context.
Integrity & changes
Trace changes to critical files and services.
NODE64 watches critical files (e.g. SSH config, cron jobs, system files) for unnoticed changes and shows you on every login what changed since last time – new packages, newly open ports, new users or SSH keys.
The Sonar measurement network
See your network the way the internet sees it.
Your server knows which ports are open – whether they are actually reachable from the internet can only be seen from outside. NODE64 Sonar measures your own systems from other locations: reachability and latency (ping), the route there (traceroute) and whether your DNS answers correctly everywhere – for IPv4 and IPv6. Your device can optionally act as a measurement point itself.
Detecting what nobody has seen yet
A virus scanner knows what has been written down. NODE64 learns what your server normally looks like — and notices when it behaves differently. That catches tomorrow's variant too.
Ransomware
Three independent measurements, none needing a signature. Entropy: encrypted data carries close to eight bits of information per byte, text and source code four to five — already-compressed formats such as images and archives are not measured at all. Extension clustering: if a single extension suddenly accounts for the majority of changed files, that is a renaming sweep. The comparison is not against a list but against what has ever existed on this system — ransomware picks its extension freely, and that is exactly what gives it away. Anchor files: NODE64 remembers checksums of files untouched for months. If several change in one run, something has reached indiscriminately through the data.
Back doors and malicious code
Served files are checked for constructs that execute characters supplied over the network as program code — the construction of every back door. Plus statistical analysis: it asks not what is in a file but how it looks. Very long unbroken strings and an almost even character distribution are the mark of an embedded data block. That cannot be evaded by writing the code differently. Planted spam senders and executable files in directories that should only hold data are found as well — the most common way into a server.
Break-in and persistence
Whoever gets in once secures the way back. NODE64 knows your system inventory and reports what joins it: a second user account, an installed SSH key, a new sudo grant, a new open port, a service that starts at boot. Plus the successful login from an origin this account has never used — the provider is compared, not the address, so a connection with a changing IP does not raise false alarms.
What talks outward
A miner, a remote control and a data leak look different on disk — on the network they look the same: a server service talking persistently to an address it otherwise never uses. NODE64 remembers the relationship between process and destination network, not the individual connection. The same address can be normal for the backup service and highly odd for PHP-FPM — so who is speaking counts, not only to whom.
The coincidence
Ten numbers describe your server: running services, open ports, accounts, keys, processes, changed files and more. NODE64 learns from them what it normally looks like. Two more accounts, one more key, one more port, three more services — each number unremarkable on its own, together an installation. This adding-up of weak signals is exactly why others reach for a neural network. NODE64 manages with a median — and can afterwards say which four numbers it was.
And what it cannot do
NODE64 checks at fixed intervals, not in real time. Anyone needing a reaction within seconds needs a file-system watcher in addition. It detects and explains — it deletes nothing, kills no process and blocks no connection. The agent only reads: no decoy files, no markers, no changes to your data. And where history is missing for a judgement, it says so plainly instead of a number implying certainty.
How it works
1
Install the agent
Start a small container on your device.
Runs on Raspberry Pi, mini-PC, Proxmox container or a router with container support – minimal footprint.
2
Send data securely
The agent collects locally and sends encrypted to your NODE64 server.
“Phone home” over HTTPS: bulk telemetry in batches, critical alerts instantly.
3
Analyse centrally
Everything lands in your dashboard – including CVE checks and alerts.
Analysis, hardening status and notifications in one place.
The agent: what it does – and what it does not
Anyone giving a tool access to their server wants to know first what it does not touch. That is why both sides stand side by side here, not one of them in the small print.
What it does
- Reads the system state: packages, services, ports, accounts, configurations, disks.
- Runs locally and sends an archive – no permanent connection, no open port.
- Verifies the signature of every instruction from the server before acting on it.
- Open source and without a single third-party library – rebuildable with nothing but the Go standard library.
- Keeps running when the connection drops and sends later.
What it does not do
- Changes nothing. No package installed, no service restarted, no file touched. That is compiled in, not configured.
- Runs no commands coming from the server. There is no remote administration.
- Transmits no log lines – only counts. You see the lines themselves on the machine.
- Transmits no file contents, no databases, no user data.
- Accepts no connection from outside. There is nothing to connect to.
Supported systems
NODE64 monitors virtually anything an agent runs on: Raspberry Pi, mini-PCs, Proxmox hosts and containers, Docker/container hosts and routers (coming). Home lab or business: one agent, one central dashboard.
- Raspberry Pi & SBCs
- Mini-PCs & servers
- Proxmox hosts & containers
- Docker/container hosts
- Routers (coming)
What we wrote ourselves – and what we did not
Every library that comes along is somebody else's code with the same rights as ours. For the agent we wanted that down to zero. Where we did not want it, you see on the right – and the reason matters more than the list on the left.
Written by us
- ICMP and traceroute. Eight bytes of header and a checksum – that needs no library.
- SNMP v1, v2c and v3, including BER encoding. Verified byte by byte against the canonical packets of the specification.
- The PDF generator for the reports. It uses the fourteen standard fonts, so none has to be shipped.
- Four version rules – dpkg, rpm, PEP 440 and FreeBSD ports. Each compares differently; treating them alike hides vulnerabilities.
- The world map, drawn server-side. No map service, no loading, no JavaScript.
Deliberately not written by us
- Cryptography. Encryption, checksums and signatures come from the Go standard library. We invent none – we only wire them up, and that wiring is verified against the test vectors of the respective specification.
- TLS. Standard library as well. Home-made TLS would be grossly negligent.
- On our server two PHP packages are in use: mail delivery and QR codes for two-factor login.
- The interface uses Bootstrap and Chart.js – served by us, not from a third-party host.
The difference is not pride but responsibility: a bug in code we wrote is our bug and fixed tomorrow. A bug in a package that changes owner overnight is not.
Alerting
Not every finding is worth a message. Alerts have rules, recipients and a quiet period.
- Rules by severity, device group and finding type.
- Email and webhook; test alert with one click.
- Repeat suppression – the same finding does not wake you twice.
Reports
A PDF you can hand on – to your boss, your customer or your auditor.
- Per device and across all systems, with history and resolved findings.
- Cover page with your details, if you have entered them.
- Generated in-house, without a third-party library – and without data leaving the building.
Compliance
The checks are mapped to the modules of BSI IT-Grundschutz and the controls of ISO 27001.
- Three states: met, not met – and not technically verifiable.
- The ratio counts only what can be checked. Everything else stands next to it.
- An implementation aid, not a certification. Only accredited bodies may certify.
The Sonar measurement network
Check from outside what cannot be seen from inside: is the port really open? Does the connection arrive? Volunteer probes measure for one another.
This is the actual state: 4 probes in 1 countries. Not a screenshot – the same map as in the dashboard.
🇩🇪 Everything in Germany.
Your data is processed and stored exclusively in Germany – on servers at Hetzner. This applies to all data: even anonymised uploads (or data anonymised on the agent itself) stay on German hardware.
- Servers & backups at Hetzner
- No third-country transfers
- Data processing per Art. 28 GDPR
Sounds like what you have been missing?
Getting started is free: create an account, start the agent, look at your first recommendations.