Current version: 2026.10.28
Reef is a self-hosted Linux security stack in a handful of Docker containers. It includes reliable and proven scanners to keep an eye on file integrity, audit events, Lynis hardening, ClamAV and YARA malware scans, OpenSCAP benchmarks, and Grype vulnerabilities, plus always-on USB device and disk health monitoring, all wrapped up in one clean dashboard that turns raw tool output into ranked, deduplicated findings and sends you a notification when something matters. You get the visibility of a monitoring platform like Splunk or ELK without the licensing bill, and without the weeks of assembly that rolling your own from open-source parts demands.
High-end SIEMs are priced for enterprises and take a team to run. The raw open-source tools are excellent, but you are left wiring together collectors, parsers, schedulers, and a UI before you see a single finding. Reef ships that whole layer as one docker compose stack: a privileged agent runs the scans against your host, a worker parses the output into findings, and a lean web app is your reporting and notifications hub. There are no restrictions on the number of agents you can deploy! One price, no limits!
Mac agent support coming soon
Reef is built for modern Linux servers. The agent scans the host it runs on, so that host must be Linux running Docker with Docker Compose.
LinuxSupported
macOSNot tested or supported
WindowsNot supported, including Docker Desktop
Each scanner answers a different question about the health of your host, and together they cover four goals: detect tampering, catch malware, harden and comply, and patch what matters first. Every scan runs on a predefined schedule or on demand, and Reef normalizes every result into a Finding with a severity rating, a plain-language explanation, and a status you manage for visibility and tracking.
Did anything on disk change that shouldn't have?
Reef keeps a per-host baseline of hashes and attributes for the file-system paths that matter. Every re-scan compares the host against that baseline, so an unexpected edit to a config file or binary shows up as a finding instead of going unnoticed.
Who did what on this host, and is anyone watching?
Reef checks that auditd is running with a best-practice ruleset loaded, then reads new audit events incrementally from a checkpoint and classifies the ones that matter.
Is a known piece of malware sitting on this host?
ClamAV sweeps the writable, higher-risk directories, such as /home, /root, /tmp, and /opt, and checks every file against its database of known malware signatures.
Works alongside the YARA scanner (4): ClamAV matches known files, and YARA matches patterns that signatures miss.
Does anything match the patterns of malicious code?
Where ClamAV matches files against known malware, YARA looks for the strings, byte sequences, and other indicators that families of malicious code have in common. Reef bundles its own rule set, so there is nothing to download or maintain, and new rules arrive with regular releases.
Works alongside the ClamAV scanner (3) for a second, independent look at the same directories.
How hard is this host to break into?
Reef runs a full Lynis audit in the host's own namespace. Every warning and suggestion is enriched from an offline knowledge base, so you get a to-do list instead of raw tool output.
Does this host meet the benchmark I'm held to?
OpenSCAP evaluates the host against the CIS, STIG, PCI-DSS, or other SSG profile you pick. It runs in detection mode only and never auto-remediates, and it reads each rule's title, rationale, and fix text straight from the datastream it ran.
.cklb checklist export, ready for eMASSWhich vulnerabilities on this host are attackers actually using?
Syft catalogs a complete SBOM of the host, and Grype matches every package against known CVEs. Each match is cross-referenced against the CISA Known Exploited Vulnerabilities (KEV) catalog, so the ones being exploited right now rise to the top of the list.
The overview shows findings by severity, which scan types have current coverage, agent health, and recent scan activity. Drill into any scan to watch it run and see exactly what it produced.
Findings have a lifecycle you actually use: open, acknowledged, resolved, and suppressed. Repeat sightings are deduplicated and bump a "last seen" timestamp. When a later authoritative scan stops reporting a finding, Reef resolves it for you and reopens it if it comes back.
Need to hand results to someone else? Export any scan as an executive summary report in Markdown or plain text.
The whole UI is server-rendered with vanilla JavaScript. No framework, no build step, no client-side sprawl.
Pick a profile such as: cis_server_l1, stig, pci-dss, and more and Reef runs the OpenSCAP scan against your host. Each result gives you a compliance percentage and pass, fail, and manual counts.
Then, export it as a STIG Viewer 3 .cklb checklist ready for eMASS. Passes and failures are filled in for you; anything the scanner could not verify is left for a human to review.
When a fix will take time, group the related findings into a POA&M (Plan of Action & Milestones) with an owner, a due date, and milestones. Its timeline keeps your team's notes and automatically records every status change on its findings, including the ones a scan resolves or reopens. Reef sends a notice when a POA&M goes overdue, and you can export it as CSV.
A CVE list is just noise until you know which entries matter today. Reef cross-references every Grype match against the CISA Known Exploited Vulnerabilities catalog and pins actively exploited ones to the top of the findings list with a badge, a dedicated filter, and a dashboard tile. Missing CVSS scores are back-filled from a baked-in NVD index, and the full package inventory is kept in the scan summary so you can see exactly what is installed.
Scans run on a schedule, but some events can't wait for the next one. Alongside the scanners, the agent keeps a continuous, read-only watch on what is plugged into the host and on the health of its disks.
Every 30 minutes the agent reads each drive's SMART data without waking drives that are in standby. Reef rates each disk OK, warning, or failing based on signs such as reallocated or pending sectors, NVMe media errors, worn-out endurance, failed self-tests, and high temperatures.
You get a notification only when a disk picks up a new problem, so a failing drive gets noticed before it takes your data with it.
Every minute, Reef records the USB devices and removable media connected to the host. It reads the kernel log as well, so a device that is plugged in and pulled out between two checks still shows up in the history.
The CISA KEV catalog, the NVD CVSS index, and current SCAP compliance content are all downloaded and baked into the image at build time. At scan time Reef makes no outbound calls for threat intelligence. A point-in-time snapshot refreshes on every image rebuild.
The privileged agent that touches your host has no database access and no application code. It authenticates with an API key, self-identifies by hostname, reads the host mounted read-only, and only ever ships raw tool output back. All parsing happens server-side.
Point Reef at a dedicated Ollama instance and every finding gets a plain-language interpretation on top of the rule text: what likely caused it, how urgent it really is in context, and a suggested remediation path. Ask it about one finding from the detail drawer, or run it against an entire scan's results at once for a single narrative summary of what a scan pool turned up.
The model runs on infrastructure you own. Reef sends findings to the OLLAMA_URL you configure and nothing else - no finding data, host inventory, or scan output goes to a third-party API. That keeps AI interpretation inside the same no-outbound-calls posture as the rest of Reef, so it is a fit for air-gapped and locked-down networks, not just an add-on. Reef is fully tested against Llama and Qwen-family models served through Ollama.
No external database to stand up, no framework build step, no cloud dependency. Copy the example environment file, set three secrets, and bring the stack up.
| web | Django on gunicorn: Contains the dashboard and web API |
| worker | Celery: Parses raw scan output into findings and runs the notification rules |
| beat | Celery scheduler: Enqueues scans, expires stale jobs, and flags offline agents |
| redis | The task broker |
| agent | The privileged scanner; its own image, no database, no app code |
State lives in SQLite on a shared volume. web, worker and beat are the same image run in different roles. An optional Ollama container for AI interpretation is included as a compose profile.
# 1. start from the template and set three secrets cp .env.example .env # 2. Login to the PortIgniter Registry docker login registry.portigniter.com # 3. Start the stack docker compose up -d # 4. open the dashboard — the host agent # checks in within ~15 seconds open http://localhost:8000/
Nightly file integrity, hourly audit, daily ClamAV, YARA, and CVE scans, plus weekly Lynis and OpenSCAP CIS benchmarks are seeded on first start. Edit them in the admin or run any scan on demand.
Findings at or above your severity threshold, unrecognized USB devices, failing disks, and overdue POA&Ms raise an in-app notification and send an email copy, so you hear about a critical without watching the dashboard. The notification feed is searchable.
Every knob - scan paths, thresholds, retention, poll intervals - is an environment variable. There is nothing you need to edit inside the container.
Reef Standard Edition is licensed at $100 USD per year and includes regular, monthly updates which include refreshed threat-intel snapshots, new and improved scanners, and dashboard enhancements. Standard is designed for smaller organizations that do not need a HA deployment. Since it's licensed under the MIT license, you can opt not to renew and still use the software indefinitely. Buy a license below, or get in touch to talk through a deployment for your environment.
SQLite-based single Web deployment. For small organizations that need a simple Docker-based deployment to get up and running fast. No limits on agents, users, or scans!
| License $100/year | |
| MIT License | |
| Unlimited Agents | |
| All scanners | |
| Docker Compose deployment |
PostgreSQL-based multi Web deployment for organizations that need High Availability. Pro comes with a pre-made Helm chart for easy deployment to your Kubernetes cluster.
| License $250/year | |
| MIT License | |
| Unlimited Agents | |
| All scanners | |
| Helm Chart for Kubernetes |