See Every Threat. Stop Every Attack. Know Exactly What Happened.
Modern Endpoint Defense with Built-In AI Investigation — AI-Powered Dynamic Endpoint & Site Security, Threat Detection, Auto-Inoculation, DFIR (Digital Forensics Incident Response), Investigation Recording, SOAR, SIEM, EDR, XDR Light, and more.
Auto-Inoculate site clients to maintain internal defense across every machine on a site license.
RDP, SQL Server, credential brute force, and connection floods are how Windows boxes actually get breached. SYSMarshal watches all four in the Windows event log and firewall in real time — observing, correlating, and blocking at machine speed, with no SOC team to run it.
Exposed RDP is the number-one ransomware doorway. SYSMarshal reads every logon and failed-logon event the instant it fires, fingerprints the source IP, and shuts out credential-stuffing sessions before an attacker gets a foothold.
The moment SQL Server is reachable, attackers scan 1433 and 1434 for it. SYSMarshal gates those ports by IP, flags injection and login-probe patterns, and blocks the source — leaving a tamper-evident audit trail behind every hit.
Failed-logon storms don’t get retries — they get blocked. Once a source IP crosses your configurable threshold inside the time window, it’s dropped at the Windows Firewall and stays blocked until you clear it.
Connection floods and resource-exhaustion runs give themselves away by velocity. SYSMarshal’s flood report surfaces abnormal request storms as they build and auto-blackholes the sources, so real users keep getting answered while the noise gets dropped.
Tap any capability for the engineering detail — what it watches, the rules it enforces, and exactly how SYSMarshal responds.
Reads the Windows Security log live — 4625, 4776, 18456 and more — and correlates logon storms across every endpoint.
Every verdict becomes a Windows Firewall block rule automatically — single IPs, ranges and CIDR blocks.
Auto-Inoculation blocks the IPs the global SYSMarshal fleet already flagged — before they ever reach you.
Every hostile IP scored and mapped — AbuseIPDB reputation, RDAP/WHOIS ownership and GeoIP location.
A live posture score, attack-spike alerts and a world map of exactly where your hits originate.
IP diagnostics, connection-flood reports, ping watch and W3C IIS-log parsing with suspicious-pattern detection.
Every session becomes a case — evidence timeline, captured artifacts and an audit-ready TXT / CSV export.
Ask your data anything — plus ten one-click DefCon scans that turn live forensics into PDF reports.
The highlight reel — real-time detection and response, global threat intelligence, the SOC dashboard, incident investigation, the AI copilot and the built-in toolbench.
Administrators, engineers and owners running SYSMarshal on Windows servers and workstations — in their own words.
“Our RDP servers were taking thousands of failed logons a night. SYSMarshal picked the pattern out of the Security log and had the source ranges in a firewall block rule before anyone was awake to look at it.”
“Auto-Inoculation is the part that sold the second licence. Addresses that hit other sites first never got a single packet into ours, and the recency cutoff keeps the rule set from growing forever.”
“The case timeline is what our insurer actually wanted to see. Evidence, artifacts and the exact sequence of events exported to one report, instead of me stitching screenshots together for a week.”
“Every verdict lands as a real Windows Firewall rule. No agent fleet, no console to babysit, nothing sitting between us and the traffic. It uses the firewall we already trusted.”
“Being able to ask plain questions of our own event data — which addresses came back after a block, what changed this week — saves the part of the job I used to do in SQL at midnight.”
“The posture score and the origin map made this legible to people who do not read event logs. It is the first time our leadership has understood what the perimeter absorbs in a week.”
“The IIS parser surfaced a scanner walking our admin paths that nothing else had flagged. Suspicious requests, top URLs and status codes sorted for me in a single pass.”
“Constant probing on 1433 was our loudest noise source. It is quiet now, and 18456 events go through the same pipeline as everything else instead of a log nobody opened.”
“It told us a service had been stopped outside the app before anyone noticed the symptom. That transition is now on the case timeline with a timestamp, which is what we needed.”
“The built-in terminal means I am not hopping between four windows during an incident. Script, run, read the output, capture it to the case, all without leaving the console.”
“Adding our own event IDs took minutes, and the browser makes it obvious which ones actually fire. We stopped guessing at what to watch.”
“Installed on a Friday, blocking by Friday afternoon, and I have not had to learn a security product to keep it working. That was the whole requirement.”
RDP and SQL brute force, credential attacks and connection floods — SYSMarshal watches the Windows event log, decides, and blocks hostile IPs at the firewall in real time.
Product updates and security notes — no noise, unsubscribe anytime.
Autonomous threat defense for Windows servers and endpoints — real-time event monitoring, automatic firewall enforcement, global threat intelligence and AI-assisted analysis, in one console.