Every scan on this site so far — Regular, Advanced, Exposure — looks at your domain from the outside, the way an attacker would. The SolveBeat Agent is different: it runs on your own server and checks what's actually going on inside it.
Add a server → See pricingNo agent-management console to learn, no complex config file — one command, run once.
From your dashboard, name the server and (optionally) link it to one of your domains.
Copy the one-liner shown and run it with sudo (Linux) or as Administrator (Windows).
This is illustrative — the real command with your actual one-time token is generated when you click "Add server" in the dashboard. Copying this exact line will not work.
The installer sets up a daily scheduled task automatically — nothing to configure or remember.
Findings show up in your dashboard, and in that domain's L2/L3 PDF reports if you linked one.
All read-only — the agent never changes a setting, only reports on it. Includes both static configuration checks and, as of the latest version, behaviour-based threat hunting against the server's own event log.
Flags OS and package updates that haven't been installed yet, before they become the way in.
Root login over SSH, password-only authentication, RDP without Network Level Authentication — the settings that turn a server into an easy target.
Confirms ufw/iptables/firewalld (Linux) or Windows Firewall and Defender are actually switched on, not just installed.
World-writable files in system paths, unusual SUID binaries — the small misconfigurations that add up.
Enabled Guest accounts, an unusually large local Administrators group — access that's easy to forget about.
BitLocker status and whether the obsolete, WannaCry-era SMBv1 protocol is still switched on (Windows).
Scans the last 24h of the local event log for obfuscated/encoded PowerShell commands and suspicious use of mshta, wevtutil or certutil — classic payload-delivery and log-clearing techniques.
Flags a hidden admin account hiding behind the reserved Administrator RID, a burst of failed logons in the last 24h, and any scheduled task registered in that window.
Catches the classic Pass-the-Hash signature (an NTLM network logon to a local admin account) — the textbook sign of stolen-credential lateral movement between servers.
Each of the checks above is backed by a real, published MITRE ATT&CK technique ID and comes with a short response playbook right in your dashboard — what to check first, what to isolate, what to reset. The underlying detection logic for each one is also published as a standard Sigma rule, the same portable format used by Splunk, Elastic, and QRadar.
The agent only ever sends data to SolveBeat — it never receives commands to execute. Every check it runs is fixed in the script itself, and the script (plus the installer) is published for you to read before you run it with elevated privileges. If you want to see exactly what it does before installing anything, the source is right here: agent-linux.sh / agent-windows.ps1.
Log in, add your first server, and it'll report within a day.
Go to Servers →