nullWarden.

A small endpoint detection and response system. One server, a handful of agents, rules you can actually read.

$ nullwarden status

agents connected .......... 3

events last hour ......... 1,204

rules enabled ............. 41

active threats ......... null

watching.

Read the source See how it works

MIT licensedself-hostednot a product

What it does

Four moving parts.

An agent watches each machine. The server decides what matters. You get told, and you can do something about it.

collect: Process, network, file, and auth events from each endpoint. A small agent batches locally and streams over an authenticated socket.
detect: Events matched against open detection rules, written in plain YAML. Rules live in the repo. Read them, change them, write your own — that's the point.
alert: A dashboard that stays quiet until something is worth your attention. Live event stream, fleet health, and a triage queue that fits on one screen.
respond: Kill a process, isolate a machine, or flag it for later. Every action is logged with who issued it. Destructive actions are opt-in per agent.

How it works

One server. One database. One command to start it.

Deliberately boring. Agents report to a single service that stores events, runs them past your rules, and pushes anything interesting to the dashboard in real time.

agent→ ingest→ rules→ threat: null

Layer	Choice	Why this one
server	FastAPI	Async ingestion, typed at every boundary.
storage	PostgreSQL	Relational where we query, JSONB where events vary. One dependency.
dashboard	React	Live event stream over WebSockets.
agent	Python	Start simple. Rewrite in Go if it ever needs to be smaller.
rules	YAML	An open format. Detection knowledge should be legible, not locked in an engine.
deploy	Docker Compose	It runs on hardware you already own.

Status

Early, and honest about it.

Built in the open. The commit history is the documentation — you can watch it come together, sharp edges and all. Expect breaking changes and TODO comments that mean it.

Scope: nullWarden is for machines you own or administer. A homelab, your own VMs, a small team's laptops — up to around ten devices. It is not an enterprise platform and it isn't trying to become one.

It's a learning project, made properly.