Reef is a self-hosted Linux security stack as a handful of docker containers. It includes reliable and proven scanners to keep an eye on file integrity, audit data, Lynis reports, ClamAV scans, OpenSCAP benchmarks, and Grype vulnerabilities all wrapped up in one clean dashboard that turns raw tool output into ranked, deduplicated findings and sends you a notification when something matters. You get the visibility of a monitoring platform like Splunk or ELK without the licensing bill, and without the weeks of assembly that rolling your own from open-source parts demands.
Pro Edition will be available November 1, 2026
High-end SIEMs are priced for enterprises and take a team to run. The raw open-source tools are excellent, but you are left wiring together collectors, parsers, schedulers, and a UI before you see a single finding. Reef ships that whole layer as one docker compose stack: a privileged agent runs the scans against your host, a worker parses the output into findings, and a lean web app is your reporting and notifications hub. There are no restrictions on the number of agents you can deploy! One price, no limits!
Each scan runs on a pre-defined schedule or on-demand. Reef normalizes every result into a Finding with an associated severity rating, a plain-language explanation, and a status you manage for visibility and tracking.
A per-host baseline of hashes and attributes for the file-system paths that matter. Every re-scan reports new, content-changed, removed, and permission-changed files.
Checks that auditd is running with a best-practice ruleset loaded, reports coverage gaps per rule key, and classifies new events like account changes, sudo commands, brute-force, MITRE ATT&CK-tagged syscalls, incrementally from a checkpoint.
A full Lynis audit run in the host's own namespace. Every warning and suggestion is enriched from an offline knowledge base: what it means, why it matters, how to fix it, plus an upstream docs link and a hardening index.
ClamAV sweeps the writable, higher-risk directories such /home, /root, /tmp, /opt, etc. and raises a critical finding per infected file. Bundled YARA rules look for signatures and malicious indicators.
OpenSCAP evaluates your host against select CIS, STIG, and other SSG profiles. It operates in detection only, never auto-remediation. It reads each rule's title, rationale, and fix text straight from the datastream it ran.
Syft catalogues a complete SBOM of the host and Grype matches it against known CVEs. Actively-exploited vulnerabilities are tagged from the CISA KEV catalog and floated to the top of the list.
The overview shows findings by severity, which scan types have current coverage, agent health, and recent scan activity. Drill into any scan to watch it run and see exactly what it produced.
Findings have a lifecycle you actually use: open, acknowledged, resolved, and suppressed. Repeat sightings are deduplicated and bump a "last seen" timestamp. When a later authoritative scan stops reporting a finding, Reef resolves it for you and reopens it if it comes back.
The whole UI is server-rendered with vanilla JavaScript. No framework, no build step, no client-side sprawl.
Pick a profile such as: cis_server_l1, stig, pci-dss, and more and Reef runs the OpenSCAP scan against your host. Each result gives you a compliance percentage and pass, fail, and manual counts.
Then, export it as a STIG Viewer 3 .cklb checklist ready for eMASS. Passes and failures are filled in for you; anything the scanner could not verify is left for a human to review.
A CVE list is just noise until you know which entries matter today. Reef cross-references every Grype match against the CISA Known Exploited Vulnerabilities catalog and pins actively exploited ones to the top of the findings list with a badge, a dedicated filter, and a dashboard tile. Missing CVSS scores are back-filled from a baked-in NVD index, and the full package inventory is kept in the scan summary so you can see exactly what is installed.
The CISA KEV catalog, the NVD CVSS index, and current SCAP compliance content are all downloaded and baked into the image at build time. At scan time Reef makes no outbound calls for threat intelligence. A point-in-time snapshot refreshes on every image rebuild.
The privileged agent that touches your host has no database access and no application code. It authenticates with an API key, self-identifies by hostname, reads the host mounted read-only, and only ever ships raw tool output back. All parsing happens server-side.
Point Reef at a dedicated Ollama instance and every finding gets a plain-language interpretation on top of the rule text: what likely caused it, how urgent it really is in context, and a suggested remediation path. Ask it about one finding from the detail drawer, or run it against an entire scan's results at once for a single narrative summary of what a scan pool turned up.
The model runs on infrastructure you own. Reef sends findings to the OLLAMA_URL you configure and nothing else - no finding data, host inventory, or scan output goes to a third-party API. That keeps AI interpretation inside the same no-outbound-calls posture as the rest of Reef, so it is a fit for air-gapped and locked-down networks, not just an add-on. Reef is fully tested against Llama and Qwen-family models served through Ollama.
No external database to stand up, no framework build step, no cloud dependency. Copy the example environment file, set three secrets, and bring the stack up.
| web | Django on gunicorn: Contains the dashboard and web API |
| worker | Celery: Parses raw scan output into findings and runs the notification rules |
| beat | Celery scheduler: Enqueues scans, expires stale jobs, and flags offline agents |
| redis | The task broker |
| agent | The privileged scanner; its own image, no database, no app code |
State lives in SQLite on a shared volume. web, worker and beat are the same image run in different roles.
# 1. start from the template and set three secrets cp .env.example .env # 2. Login to the PortIgniter Registry docker login registry.portigniter.com # 3. Build the images and start the stack docker compose up --build # 4. open the dashboard — the host agent # checks in within ~15 seconds open http://localhost:8000/
Nightly file integrity, hourly audit, weekly Lynis, daily malware and CVE scans are seeded on first start. Edit them in the admin or run any scan on demand.
Findings at or above your severity threshold raise an in-app notification and send an email copy, so you hear about a critical without watching the dashboard.
Every knob - scan paths, thresholds, retention, poll intervals - is an environment variable. There is nothing you need to edit inside the container.
Reef Standard Edition is licensed at $100 USD per year and includes regular, monthly updates which include refreshed threat-intel snapshots, new and improved scanners, and dashboard enhancements. Standard is designed for smaller organizations that do not need a HA deployment. Since it's licensed under the MIT license, you can opt not to renew and still use the software indefinitely. Get in touch to reserve a license or to talk through a deployment for your environment.
SQlite-based single Web deployment. For small organizations that need a simple Docker-based deployment to get up and running fast. No limits on agents, users, or scans!
| License $100/year | |
| MIT License | |
| Unlimited Agents | |
| All scanners | |
| Docker Compose deployment |
PostGRES-based multi Web deployment for organizations that need High Availability. Pro comes with a pre-made Helm chart for easy deployment to your Kubernetes cluster.
| License $250/year | |
| MIT License | |
| Unlimited Agents | |
| All scanners | |
| Helm Chart for Kubernetes |
