Frequently asked questions.

SYSMarshal is an autonomous security tool for Windows servers and endpoints. It reads the Windows event log in real time, identifies the IPs behind attacks like RDP and SQL brute force, and automatically blocks them at the Windows Firewall — enriched by a global threat-intelligence feed and, on Professional licences, an AI security analyst.

It installs as a background Windows service (which does the work) plus a desktop console (which lets you see and steer it).

• RDP & Windows logon brute force — repeated failed logons (event 4625)
• SQL Server brute force — failed database logins (event 18456)
• Credential attacks — NTLM validation failures and password-change attempts (4776/4777/4723)
• Network intrusion attempts — packets/connections dropped by the Windows Filtering Platform (5152/5157)
• Unauthorized share access (5140)
• Connection floods — abnormal request storms surfaced by the flood report and auto-blackholed
• Web attacks — path traversal, SQL injection, XSS, webshells and scanners flagged from IIS logs

One continuous loop, running in the background service: observe the event log for the IDs you monitor, correlate failures per source IP and attach reputation and geolocation, decide when an IP crosses your threshold (after checking the whitelist), act by writing it to the single SYSMarshal IP Jailhouse firewall rule, and learn by feeding and pulling the global blacklist so you block IPs that hit other machines first.

• System administrators running internet-facing Windows Server (RDP, SQL Server, IIS)
• Managed service providers and hosting companies protecting many machines
• IT and security teams that need a real-time, IP-level blocking layer
• Any organisation that needs an exportable audit trail of blocked threats

No — it complements them. SYSMarshal adds a focused, real-time IP-blocking layer on top of Windows Firewall and your existing AV/EDR, and it touches only its own dedicated rule, so your other firewall configuration is left completely untouched.

Yes — on-premises, in AWS, Azure or Google Cloud, or in hybrid environments. The machine still has to run a supported operating system: Windows 10, Windows 11, or Windows Server 2019, 2022 or 2025.

• Supported operating systems (64-bit only): Windows 10, Windows 11, or Windows Server 2019, 2022 or 2025. These are the only platforms SYSMarshal supports — it does not run on Linux, macOS, or earlier Windows releases such as Server 2016 or Windows 8.1.
• Privileges: administrator rights (needed to read the Security log and manage firewall rules)
• Prerequisites: the installer sets these up for you automatically — a local SQL Server Express instance, the Visual C++ runtime and the Microsoft Edge WebView2 runtime
• Disk: a few hundred MB, plus room for the local database as history grows

Run the SYSMarshal setup. The bootstrapper installs the desktop console, the background service and its Watchdog, and the local database, and it also handles updates, repair and uninstall later. Once installed:

• Enter your API Key under Settings → Licensing
• Whitelist your own IPs under Settings → White Listing
• Install and start the service from the Service Monitor tab

Whitelist your own IP addresses — office, VPN, remote-admin and any monitoring or vulnerability-scanner sources — before you start the service. This is the one step you must not skip; it prevents SYSMarshal from ever blocking your own access to the server.

The defaults are sensible for most environments. The settings worth reviewing are:

• Scan Settings — how many failures within what time window trigger a block
• White Listing — trusted IPs and whether private addresses may ever be blocked
• Notifications — alert email and cadence
• Appearance — Light/Dark theme, font and language

Most rows save the moment you leave the field; theme and language apply on the next restart.

Yes. When an IP crosses your configured threshold, SYSMarshal writes it to the Windows Firewall in real time — no console, no ticket, no waiting for a human. Because the block lives in the OS firewall, it holds even when the app is closed, and the IP stays blocked until you clear it.

Absolutely. Whitelisted IPs are permanently exempt from blocking, no matter how much activity they generate, and the whitelist is stored encrypted. You can add single addresses or ranges, and optionally tell SYSMarshal never to block private (RFC-1918) addresses.

The Baseline Protection tab surfaces IPs already caught attacking other SYSMarshal-protected machines worldwide, each with a confidence score, severity, attack vector and geolocation. Auto-Inoculation can then block those IPs for you automatically on a schedule — so you're protected against threats that haven't reached you yet. It's herd immunity for your infrastructure.

On Professional licences, SYSMarshal includes an AI security analyst: ten one-click DefCon forensic scans that collect telemetry from the machine and return a full report, plus AI analysis in Data Explorer (attack-pattern, suspicion-score, anomaly and IP-intelligence reports) and script explanation in the Terminal. AI features need the AI Secret Key from Settings → Licensing, which is tied to a prepaid balance.

Yes. The Dashboard is a live security-operations console — a 0–100 posture score, attack-spike alerts, an offline threat-origin world map, and attack breakdowns by IP, country, port, vector and time. The Investigation tab builds case files with evidence timelines, and reports export to CSV/TXT (with PDF for the AI reports).

• Email — Immediate, Daily Summary or Weekly Summary to any number of recipients
• Desktop toasts — a pop-up the moment a new IP is blocked
• Watchdog alerts — an email if the SYSMarshal service ever stops unexpectedly (capped at one per hour)

SYSMarshal is lightweight and runs in the background. Crucially, it's host-based and event-log-driven — it does not sit inline in your network path, so it adds no latency to legitimate connections. Scans run on a configurable interval, and long work is done off the UI thread.

SYSMarshal has exactly two licence types:

• Trial — the full local defender with your Site threat data, so you can evaluate it in your own environment.
• Professional — adds the AI Assistant (DefCon scans and AI analysis), the Global-data toggle in Baseline, full hostnames, and covers every machine on your licence, site-wide.

See Our Products for current pricing and seat options.

Yes — start a Trial from Our Products and run the full local defender against your own traffic before you buy.

Yes. Professional is site-wide — install SYSMarshal on every machine under your account and they share a single threat picture as your Site data. Contact us for volume and seat options.

Each installation is tied to your API Key plus the machine's hardware fingerprint. If validation briefly fails — for example during a short API outage — SYSMarshal keeps protecting you for a 12-hour grace period before it enforces the licence, so a momentary connectivity blip never leaves you exposed.

• In-app Help — every tab has a ❔ Help button with the complete reference and troubleshooting
• Documentation — the full Docs site mirrors that reference
• Support tickets — raise an issue from Support
• Contact us — reach the team directly via Contact

SYSMarshal includes a built-in updater. On startup it checks for a newer version and, if one is available, prompts you — then applies the update in place with elevation. Updates are included with an active licence, so you stay current on both features and threat intelligence.

Start with the in-app Help on the relevant tab and the Docs site, which cover the common questions and errors. For anything environment-specific, open a support ticket or contact us.

It monitors Windows event 4625 (failed logon), the signal RDP and Windows brute force produce. When a single source IP exceeds your Max Wrong Tries within the configured time window, it is blocked automatically. Both the threshold and the window are configurable under Settings.

Yes. Event 18456 (SQL Server login failure) is monitored by default, so an IP throwing repeated failed database logins gets blocked per your threshold — no extra configuration. The IIS log analyser additionally flags SQL-injection patterns in inbound web requests.

Yes. With a Professional licence, install SYSMarshal on each machine and they run their own instance while sharing threat intelligence across your licence as Site data — so an attacker caught on one machine can be blocked on the others.

Local monitoring and blocking work without internet. Connectivity is used for licence validation, the global threat feed, AI features, updates and email notifications — and the 12-hour grace period covers brief outages so protection never drops.

• The Windows Security and Application event logs — for the event IDs you choose to monitor
• IIS W3C web-server logs — for suspicious-request analysis on the Diagnostic tab

You can add any Windows event ID from any log, and the Diagnostic tab helps you discover which events on your machine carry a source IP worth monitoring.

Yes. Block lists and investigation cases export to CSV / TXT, and the AI and DefCon reports export to PDF — ready to drop into a ticket, an email or a compliance evidence pack.

Fully, end to end. IPv4 and IPv6 are handled transparently throughout — event extraction, validation, whitelist lookup, reputation and Windows Firewall insertion.