Reef is a self-hosted security monitoring tool for Linux hosts. It runs seven complementary scans on a schedule, collects the results in one dashboard, and alerts you when something needs attention. It is built for the people who have to answer for a system’s security posture: Information System Security Officers, security engineers, and GRC teams.
What Reef gives you
- One place for host security evidence. Vulnerability, malware, compliance, file integrity, and audit log results all land in the same findings list, with the same severity levels, filters, and triage workflow.
- Continuous monitoring on a schedule. Scans run automatically, so findings stay current without anyone remembering to kick them off.
- Assessment-ready output. OpenSCAP results export as a STIG Viewer checklist (
.cklb) for eMASS, and vulnerabilities on the CISA Known Exploited Vulnerabilities list are flagged and prioritized. - Plain-language explanations. Hardening findings come with what the issue means, why it matters, and how to fix it. An optional local AI assistant can summarize any scan or finding.
How it fits together
A lightweight agent on each host runs the scans and sends the raw results to the Reef server, which analyzes them, stores them, and raises alerts. The agent has read-only access to the host filesystem and holds no database credentials. See How Reef Works for the details your security review will ask about.
Seven scan types, one findings list
| Scan | What it tells you |
|---|---|
| File Integrity Monitoring | Which critical system files were added, changed, or removed |
| Auditd | Whether audit logging is configured correctly, and what notable activity it recorded |
| Lynis | How well the host is hardened, with explanations for each finding |
| ClamAV | Known malware in high-risk directories |
| OpenSCAP | Compliance with CIS, DISA STIG, PCI-DSS, and other benchmarks |
| Grype | Known vulnerabilities (CVEs) in installed software |
| YARA | Malware and indicators of compromise in files and, optionally, in memory |
See Scans for how each one supports your security controls.
Where to start
- New to Reef? Start with Getting Started to install Reef and run your first scan in a few minutes.
- Preparing a security review? Read How Reef Works for agent permissions, data flow, and storage.
- Investigating an alert? Findings and Notifications cover triage and alerting.
- Something not behaving? Check Troubleshooting.