Most incidents don’t start with an exploit. They start with something quieter: a disk that’s been remapping bad sectors for weeks, or a USB stick that was plugged in for ninety seconds while nobody was looking.
Reef 2026.10.23 gives every agent eyes on both.
Disk health, before it’s a data-loss story
Reef agents now read each drive’s SMART data with smartctl, every 30 minutes,
on SATA, SAS and NVMe alike. Results appear in a new Disk health panel on
the agent page, right under resource history:
- Healthy / Warning / Failing status for every physical disk
- Temperature, power-on time, capacity and the full SMART attribute table
- Plain-English explanations of what’s wrong: “8 reallocated sectors: the drive has already remapped bad sectors” rather than a raw counter
Reef flags the signals that best predict failure: reallocated, pending and uncorrectable sectors, NVMe media errors and worn-out endurance, failed self-tests, and drives running hot. When a disk picks up a new problem, you get one notification that links straight to that host’s disk panel. You won’t get a fresh alert every half hour about the same bad sector.
It’s strictly read-only. Reef never runs self-tests or changes drive settings, and it won’t even wake a disk that has spun down.
USB & removable media: every device, on the record
USB is still one of the easiest ways onto, or off of, a machine. Reef now keeps a running log of every USB device and removable medium on each host: flash drives, external disks, SD cards, network adapters, and keyboards.
It learns what’s normal. On first run, Reef records what’s already plugged in as the baseline. From then on, anything new and unrecognized triggers an alert. Expected? Click Mark known and Reef records who approved it.
It catches the quick ones. Reef reads the kernel’s own USB log, so a drive plugged in and pulled out between checks still shows up in the activity history.
It knows what a device really is. Reef reports what each device actually presents itself as. A “flash drive” that also types like a keyboard is the signature of keystroke-injection tools like the Rubber Ducky, and Reef raises that as critical.
It doesn’t blindly trust its own allowlist. A device’s name and serial number are easy to fake. So if an approved device suddenly starts acting like something new (your trusted thumb drive now presents a keyboard), Reef alerts critical and pulls its approval until someone looks.
Why it matters
Reef already tells you what’s vulnerable on your hosts. This release adds what’s happening to them:
- Fewer surprises. Replace a degrading disk on your schedule, not at 2 a.m.
- Physical-access visibility. Removable media and rogue USB devices are a standard part of insider-threat and media-protection controls. Reef gives you a timestamped record of what was connected and who approved it.
- Signal, not noise. Both features alert on changes, link straight to the affected host, and stay out of your findings queue. Hardware events get their own home on the agent page.
Getting it
Pull the new agent image and restart. That’s it: no new mounts, ports or configuration. Disk health reports within a minute of startup, and USB monitoring starts its baseline on the first check.
Want to tune it? REEF_DISK_HEALTH_INTERVAL and REEF_USB_INTERVAL set how
often each check runs (in seconds), and 0 turns either one off.