Reef is a Linux host security-monitoring tool. A lean Django web UI is the reporting and notifications hub; a privileged agent container runs the actual scans against the host and ships raw output back through an authenticated API; a Celery worker parses that output into findings and raises notifications.
How it fits together
The agent has no database access and no application code — it authenticates with an API key, self-identifies by hostname, runs scans against the host (mounted read-only at /host), and only sends raw tool output back. All parsing happens server-side. See Architecture for the full breakdown of each service.
Seven scan types, one findings pipeline
Reef ships seven scan types: File Integrity Monitoring, AuditD Log Parsing, Lynis, ClamAV, OpenSCAP, Grype, and a YARA scanner. Each scanner has its own raw-output parser, but all of them land in the same Finding model, the same dashboard, and follow the same notification rules. See Scans for what each one does and how to tune it.
Where to start
- New to Reef? Start with Getting Started:
docker compose upto a first scan in a few minutes. - Deploying for real? Read Configuration for the environment variables you need to set, then Architecture for how the pieces scale.
- Investigating an alert? Findings and Notifications cover triage and the alerting rules.
- Something not behaving? Check Troubleshooting.