Six steps take you from a fresh install to a Windows server that blocks attackers on its own.
SYSMarshal runs one tight loop, continuously, in the background service — observe, correlate, decide, act, learn. The desktop console is a window onto that loop; the service does the work even when the console is closed.
Twelve tabs, each a focused workspace. Click any card to jump to its documentation — and remember that every tab in the app has its own ❔ Help button with the exhaustive reference.
The default view after sign-in and a full Security Operations console for this machine. It is rendered natively by SYSMarshal from fast SQL aggregations over the local activity store — there is no external dashboard engine and nothing to deploy. A LIVE indicator confirms it is connected, and Refresh recomputes on demand.
One master control — the time range. Four pills (Today / 7 Days / 30 Days / All Time) re-scope every card, chart and map on the page. Each KPI shows a trend delta against the immediately preceding window of the same length.
| Panel | What it tells you |
|---|---|
| Headline KPIs | Total Events, Unique Attacking IPs, Blocked, Trusted IPs, Countries Seen and Last Event — each with a period-over-period delta. |
| Security Posture Score | A single 0–100 ring blending severity mix, block rate, attack spikes and new attackers. |
| Attack-Spike Banner | Appears when the last hour runs ≥ 3× the trailing-24h average and ≥ 10 events land — naming the multiplier, top vector and top country. |
| New Attackers & Repeat Offenders | Genuinely new sources (global first-seen in 24h / 7d) and the IPs that keep coming back across the most days. |
| Threat Origin Map | An offline world console (see below). |
| Charts | Threat Timeline, Top IPs / Countries, Attack Vectors & Types, Top Ports, Severity Mix, Peak Hours, a 7×24 Weekly heatmap, Protocol & Direction, and a Live Activity Feed. |
Security Posture bands:
Configure which Windows Event Log entries SYSMarshal watches. It is a master/detail layout: the event list on the left, the setup pane top-right, and a live Event Browser bottom-right that shows the actual Windows records — so you can confirm an event carries a source IP before you rely on it.
Enabled out of the box:
| Event ID | Log | What it catches |
|---|---|---|
4625 | Security | Failed logon — RDP / Windows brute force |
4776 · 4777 | Security | NTLM credential-validation failures (incl. domain controller) |
4723 | Security | Password-change attempt |
5152 · 5157 | Security | Windows Filtering Platform blocked a packet / connection |
5140 | Security | Network share accessed |
18456 | Application | SQL Server login failure — database brute force |
Select any event to edit its Name, Log Name, Event ID and Enabled flag, and to run a Manual Run for that event or for all enabled events. Manual runs are test-runs — they scan and refresh the block list without disturbing the scheduler.
4776) don't include a source IP in their raw properties. SYSMarshal can still count them, but it can never produce a firewall block from a record with no IP. Check the Event Browser's Raw Event Properties block before adding a custom event.SYSMarshal keeps every block in a single Windows Firewall rule — SYSMarshal IP Jailhouse — that drops all inbound traffic from the blocked addresses on every network profile. Your other firewall rules are never touched. This tab is the live view onto that rule.
| Property | Value |
|---|---|
| Action | Block (traffic dropped silently) |
| Direction | Inbound only — your outbound connections are unaffected |
| Local Port / Profiles | All ports · Domain, Private & Public profiles |
| Remote Addresses | The IP / range block list — the only editable row (opens the Range Editor) |
Toolbar: Import IPs (add addresses via the Range Editor), Export CSV (save the block list to iplist.csv), and Restore FireWall (rebuild the rule from every IP flagged Blacklisted in the local database).
The Range Editor opens instantly and shows every blocked address as its own row: type or paste single IPs and ranges (1.2.3.0-1.2.3.255), each row carries a green/red validity dot and an IP / RANGE / BAD badge, and a live stats bar reads Total / Valid / Invalid / Duplicates with a capacity indicator that warns when the rule is getting large.
A centralised threat-intelligence feed. It surfaces IPs that SYSMarshal's cloud has collected from reporting installations — each with geolocation, an AbuseIPDB confidence score, an inferred attack vector and a severity band — so you can block them before they ever reach you. Two sub-tabs: Blacklist & Map and Auto-Inoculation.
Site vs Global data. Site data covers every machine on your licence; Global data is the worldwide feed aggregated from every site. The toggle is a Professional feature — on a Trial licence you see Site data only.
| Column | Meaning |
|---|---|
| Confidence | AbuseIPDB score 0–100, graded green → amber → red so the worst offenders stand out. |
| Severity | High (≥75), Medium (50–74), Low (25–49), Very Low (<25). |
| Attack Vector | Inferred from the originating event ID — Brute Force (4625), Network Attack (5152/5157), SQL (18456), Password Attack (4723), Unauthorized Access (5140). |
| In Firewall | Whether the IP is already in your local block rule. |
Auto-Inoculation turns the feed into automatic protection. Enable the engine, set a confidence threshold and a sync interval (5 / 15 / 30 min, 1 h or 6 h), and optionally a recency date so stale IPs are pruned on the next sync. SYSMarshal packs blocked IPs into numbered rules (SYSMarshal - AutoInoculation #N) and deletes a chunk when it empties — so an empty Block rule can never fall back to blocking everything. The Auto-Blocked IPs view lists exactly what the engine holds, enriched with geo and threat data.
A structured browser, geo-map, action console and AI-analysis surface over the entire local SYSMarshal database — no SQL Server Management Studio required. Left panel: tables & views, a colour legend and actions. Top-right: a map that drills to the row you click. Bottom-right: the data grid.
| Table / view | Contents |
|---|---|
| RecentActivity | The main log — every IP seen, classified Blacklisted / Whitelisted / TrustedIP, with geo, ports, severity and confidence. Rows are tinted by action. |
| WhiteList · Whitelist Audit | Current allow-list (encrypted at rest) plus a temporal view of how it looked up to 60 days ago. |
| MonitoredEvent · EventIds | Editable event configuration and the event-ID reference catalogue. |
| Logs | SYSMarshal's internal application log, newest first. |
| IP Octet | A synthetic view that flags subnet-sweep attacks (many distinct fourth octets from one /24). |
Right-click any activity row to copy the IP or the whole row as CSV, flip its classification (Trusted ↔ Blacklisted), whitelist it, or open a full WHOIS / AbuseIPDB report. Two automations are built in:
| Tool | What it does |
|---|---|
| Scan Blacklist for Trusted IPs | Re-checks every blocked IP against AbuseIPDB's 90-day score; anything effectively clean (below 2) is unblocked and reclassified as TrustedIP — a fast way to recover from over-blocking. |
| Analyse with AI | Expands into a full-height AI report surface with four report types: Attack Pattern Analysis, Suspicion Score, Anomaly & Outlier Detection and IP Intelligence Briefing (PDF export). |
Four investigative tools on one tab — mine event logs for signals, ping and trace any host, and analyse IIS web logs for attack patterns.
| Sub-tab | What it does |
|---|---|
| IP Diagnostics | Lists every Windows event ID that carries a public source IP, so you can discover events worth promoting into Monitored Events. Click Total IPs for a per-IP breakdown; tick and add straight to monitoring. |
| Event Flood Report | Ranks every event by raw volume across all logs — High 1,000+, Medium 500–999, Normal <500 — the fastest way to find a crash-looping service drowning your logs. |
| Ping Monitor | Full reachability + reputation workup for any IP or hostname: ping stats, geolocation, SYSMarshal & Windows firewall membership, and a 30-hop traceroute. |
| IIS Logs | Parses W3C IIS logs and flags suspicious HTTP requests. |
The IIS analyser summarises Total Requests, Unique IPs, Error Responses and Suspicious Hits across five sub-views (Suspicious Activity, Top IPs, Top URLs, Status Codes, Raw Log Browser). Its detectors flag path traversal, SQL injection, XSS, command injection, webshell and sensitive-path probes, backup/dump-file probes, null-byte / CRLF injection, known scanner user-agents, and auth failures (401/403) and server errors (5xx).
%SystemDrive%\inetpub\logs\LogFiles. Point the folder picker at a site's W3SVC<n> folder to analyse just that site.An on-demand security scan. Click Start Security Scan and SYSMarshal mines six high-signal event IDs (4625, 5152, 5157, 4723, 5140, 5158), ranks every offending IP and exposed port, applies your ban threshold, and visualises it across Distribution / Threats / Ports tabs. This scan reports — it does not block; use Data Explorer or Baseline to act on findings.
The Ban Threshold (1–100, default 3) sets how many attempts an IP needs to count as a threat, and changing it re-evaluates the data instantly with no re-scan. Threat level scales with attempts relative to the threshold:
The Ports tab grades every observed port by what the protocol is (not by volume), and double-clicking a row opens the full list of IPs that connected on it:
| Risk | Ports |
|---|---|
| Critical | 23, 135, 139, 445, 1433, 3389, 5900 — Telnet, RPC, NetBIOS, SMB, MS SQL, RDP, VNC |
| High | 21, 25, 110, 143, 1521, 3306, 5432, 27017 — FTP, mail, Oracle, MySQL, PostgreSQL, MongoDB |
| Medium | 22, 53, 80, 443, 8080, 8443 — SSH, DNS, HTTP(S) |
| Low | everything else, including ephemeral and custom ports |
Turns monitoring activity into an auditable case file. Each monitoring session becomes a case; the security-relevant events during it are attached as evidence. It is a master/detail view — a Cases grid on top, an Evidence Timeline below — and cases are created automatically as SYSMarshal runs.
| Area | Detail |
|---|---|
| Filter bar | Narrow by Case #, Status (All / Open / Closed / Escalated), a From–To date range, or Username. |
| Cases grid | Case #, a coloured Status pill, Session Start / End, Hostname and Username. |
| Evidence timeline | Timestamp, Type, a Severity pill, Title / Description and the source IP, in time order. |
| Export Report | Saves the selected case — details plus full evidence — as a TXT or CSV file that drops straight into a ticket. |
The control panel for the SYSMarshal background service — the component that actually performs scans, evaluates thresholds and updates the firewall. The desktop app is a thin client: if the service isn't running, no automated protection happens.
A toolbar offers Install Service, Start, Stop and Uninstall Service (only the actions valid for the current state are enabled), a live status indicator, and a console that records every command's output. The status indicator and buttons refresh automatically every 5 seconds.
| Indicator | Meaning |
|---|---|
| Green Running | Registered and running — Stop and Uninstall are enabled. |
| Red Stopped | Registered but stopped — Start and Uninstall are enabled. |
| Not Installed | Not yet registered — only Install Service is enabled. |
An integrated PowerShell editor and console with a side-by-side AI assistant that understands your script. The left side is the workspace — toolbar, syntax-highlighted editor and a live console; the right side is an AI chat that can explain scripts, answer questions and hand you ready-to-run code.
The Commands dropdown is the union of the shipped scripts (<InstallDir>\POL_MMC\Commands\) and your own (%LOCALAPPDATA%\SYSMarshal\Commands\). Save a script with a shipped name and your version takes precedence — a safe way to customise built-ins. The console colour-codes output by stream ([ERROR], [WARN], [VERBOSE], progress).
-ExecutionPolicy Bypass as administrator (UAC prompt each time) and are killed after 180 seconds. The AI's Run button on a code block executes it immediately with the same privileges — read every block before you run it; the AI can be confidently wrong, especially for destructive operations.A chat-driven security analyst with ten one-click DefCon scans. Each DefCon runs an elevated PowerShell collector on this machine, ships the telemetry to SYSMarshal's AI service, and streams back a polished markdown report you can download as PDF — each on a fresh thread, so reports aren't biased by your chat. Free-form chat keeps short-term context so follow-ups work naturally.
Everything tunable, grouped into collapsible sections. Most rows save the moment you leave the field — there is no Apply button. Appearance and language are the exception: they apply on the next restart.
| Section | What you control |
|---|---|
| Appearance & Language | Light / Dark theme, UI font family and size (11–16 px), and display language: English, Spanish, French or Hindi. Applied on restart. |
| Scan Settings | SYSMarshal's own block thresholds — Max Wrong Tries, the counting window (Wrong Attempt Span, up to 180 days) and the pause between scan cycles. |
| White Listing | Whether private RFC-1918 IPs may ever be blocked, and the whitelist editor (single IPs or ranges, stored encrypted). |
| Account Lockout Policy | The Windows lockout threshold and duration, plus the 4th-octet subnet-sweep attack count. |
| Windows Event Log | Max size of the Application / Security / System logs (Security allows 20–500 MB) and the oldest entry still retained. |
| Licensing | Your API Key (licence + reputation) and AI Secret Key (prepaid AI balance). Both masked. |
| Notifications | Recipient email(s), Immediate / Daily / Weekly cadence, and batch time. |
| Account Security | Change your SYSMarshal sign-in password (min 6 chars, hashed on disk). |
| Policy Setting | Shortcuts into secpol.msc / gpedit.msc and a one-click restore of the recommended Windows audit policy. |
The engine is the loop the background service runs on a schedule (with a rapid first pass on startup to establish a baseline immediately). It's independent of the console — blocks happen whether or not the app is open.
| Setting | Controls |
|---|---|
| Max Wrong Tries | How many failure events from one IP trigger a block. 3–10 is typical; too low blocks legitimate mistyped passwords. |
| Wrong Attempt Span | The window over which failures are counted — up to 259,200 minutes (180 days). |
| Minutes to pause | Sleep time between consecutive scan cycles. |
| Allow private IPs | Whether RFC-1918 / link-local addresses can be blocked (off by default). |
| 4th Octet Attack Count | How many distinct last-octets from one /24 mark the whole subnet hostile. |
Before and after a block, SYSMarshal enriches every hostile IP from independent sources so a decision is never made on a raw address alone. A reputation lookup can even return TrustedIP, which keeps a noisy-but-legitimate source (a monitoring probe, a mail relay) from being blocked no matter how often it appears.
| Source | What it adds |
|---|---|
| AbuseIPDB | Abuse-confidence score (0–100) and reported attack categories. |
| RDAP / WHOIS | Network owner and the organisation responsible for the address. |
| GeoIP | Country, city, postal code and coordinates — feeding the maps and email reports. |
Every activity row exposes a WhoIs button that opens the full registration and abuse-history report, and the confidence score is colour-graded across the app so the worst offenders are obvious at a glance.
A separate, lightweight Windows service (SYSMarshal.Watchdog) runs independently of the main service. Its job is to make sure protection never silently stops.
| Role | Behaviour |
|---|---|
| Liveness alert | If the main service stops, the Watchdog emails you — capped at one alert per hour so your inbox isn't flooded. |
| Audit-policy self-heal | Once every 24 hours it restores the required Windows audit policy (via AuditPol /restore), so the events SYSMarshal depends on keep flowing even if Group Policy, an update or an attacker changes them. |
A dedicated bootstrapper (Patcher.exe) handles install, update, repair and uninstall. On startup SYSMarshal checks the latest available version and, if a newer build exists, offers to apply it — the Patcher then updates the installation with elevation, in place.
SYSMarshal has two licence types — Trial and Professional. Each installation is tied to your API Key plus the machine's hardware fingerprint. If the licence can't be validated (say, a brief API outage), SYSMarshal keeps protecting you for a 12-hour grace period before enforcing.
18456 (SQL Server login failure) and 4625 (failed logon, the RDP brute-force signal) are both monitored by default, so repeated login attempts against SQL Server or Remote Desktop are blocked automatically per your threshold — no extra configuration.