Skip to content
Statance
Try for freeLogin
How it worksPricingDocsMonitoring guidesIntegrationsSecurity monitoringSystem statusNetdata alternativeNixstats alternativeTry for free

Security monitoring

How Statance checks servers for outdated, end-of-life and vulnerable software, actively exploited CVEs and suspicious processes, plus daily website scans.

Security monitoring uses the same Statance agent on Linux servers — there is nothing extra to install. (The Windows and macOS agents don’t send the software inventory, so server security checks are Linux-only; website scans work for any HTTP monitor.) Full findings, alerts and website scans are included on Pro and Business. On the free plan you can see how many issues were found, counted by severity.

What’s collected

  • Security-relevant software versions: PHP, Node.js, Python, nginx, Apache, MySQL/MariaDB, PostgreSQL, Redis, OpenSSL, OpenSSH, Docker, the kernel and the OS release.
  • Distro package list: exact package names and versions from dpkg, rpm or apk, used for CVE matching.
  • Process signals: whether a process matches a known crypto-miner name, runs from /tmp, /var/tmp or /dev/shm, or has a deleted executable.
  • ClamAV detections, if ClamAV is installed on the server.

File contents are never uploaded.

How often

  • The agent reports security data every 6 hours.
  • CISA’s Known Exploited Vulnerabilities catalog is synced daily. When CISA adds an entry that affects a package on your servers, you are alerted straight away — no change on the server needed.
  • Website security scans run daily for the sites behind your HTTP monitors.

Checks

Outdated and end-of-life software

Installed versions are compared with endoflife.date. Versions past end-of-life, or behind the latest patch release, are flagged.

Vulnerabilities (CVEs)

Exact distro package versions are checked against OSV.dev. Because distro advisories are used, backported fixes are respected, which means fewer false alarms than matching on upstream version strings. Supported: Ubuntu, Debian, Alpine and RHEL-family (AlmaLinux, Rocky Linux).

Actively exploited vulnerabilities

Any CVE affecting your packages that appears in the CISA KEV catalog raises an immediate alert to the recipients on your alert rules.

Suspicious processes

Likely crypto-miners and malware patterns: known miner names, binaries running from temporary directories, and processes whose executable was deleted. These are heuristics — investigate before acting. The AI assistant can help triage findings. This is not antivirus and will not catch all malware.

Website security scan

  • Exposed .git or .env files
  • Missing security headers: HSTS, Content-Security-Policy, X-Content-Type-Options and frame protection
  • Outdated WordPress core

Severities

SeverityMeaning
CriticalAn actively exploited vulnerability (CISA KEV) or malware detected
HighEnd-of-life software or a suspicious process
MediumKnown CVEs with fixes available, or missing security headers
LowAn update is available

Reading findings

Open Security in the dashboard (/app/security). Findings are grouped by severity and show the server or website affected and what was found. Work from critical down: patch or remove actively exploited packages first, then upgrade end-of-life software and investigate suspicious processes.

API and MCP

GET /v1/security/findings

curl https://api.statance.com/v1/security/findings \
  -H "Authorization: Bearer YOUR_API_KEY"

AI agents can read the same data with the get_security_findings tool on the MCP server.

Next: REST API →