The Attack Is Already Running.
Your Scanner Is Still Reading Code.
Every exec. Every connect. Every process chain. statool deploys a kernel-level observer using eBPF — zero performance overhead, no agents inside your containers, no code changes. It watches what your processes do, not what your source code says. Real-time event monitoring, AI-powered security insights, process chain analysis, risk scoring, and CI/CD behavioral fingerprinting — all in one runtime intelligence platform.
Every execve() and connect() syscall captured the moment it fires — not sampled, not delayed. The live feed shows process name, PID, binary path, destination IP, port, and timestamp with sub-millisecond precision. No agent inside your containers. The kernel does the work.
Every process carries its full ancestry. npm → bash → curl connecting to an unknown IP is not just a curl event — it is a compromised dependency executing a shell. The full chain surfaces on every event, alert, and anomaly report. Attackers cannot hide their parentage from the kernel.
A built-in rule engine scores every event: NONE, LOW, MEDIUM, HIGH. Rules fire on reverse shells (bash -i >& /dev/tcp/…), crypto miners, suspicious binary names, and known-bad IPs. High-severity events surface immediately in the dashboard risk feed — no rules to write.
Rule engines produce lists. statool produces narratives. The AI layer reads connection spikes, unusual process chains, CI/CD anomalies, and high-risk detections — then writes a plain-English security briefing an on-call engineer can act on immediately. Powered by OpenAI; works without it too.
Record the complete behavioral signature of a known-good build — every binary run, every outbound connection. Promote it as your baseline. A malicious postInstall hook connecting to a new IP is caught the moment the connect() syscall fires, before a single byte is exfiltrated.
Raw IPs are not enough. statool resolves every destination via reverse DNS, reads /proc/<pid>/cmdline and /proc/<pid>/exe for full command-line and binary path context. Per-process statistics track connection counts, exec counts, first/last seen, and highest risk — all in one view.
"npm install" Connected To a Server In Belarus. Nobody Noticed For 47 Days.
A typosquatted package — one character off from a popular logging library — sat dormant for weeks. Its postInstall script fired on every CI run, beaconing home with the build machine's hostname, environment variables, and ~/.npmrc contents.
The attack lived entirely in the runtime — in the syscalls made during installation. A kernel-level observer would have flagged the new outbound connect() in under a millisecond, before the first byte was sent.
The Machine Reads The Pattern. You Read The Briefing.
statool's AI layer reads context: which processes spiked, which connections are new, whether CI/CD anomalies correlate with alert rules, and how current state compares to baseline. Then it writes a single paragraph an operator can act on immediately.
Insights are tiered: alert for CI/CD anomalies with new connections, warning for exec-only deviations and connection spikes, info for clean builds. Alert-level insights are always prepended to the top of the feed so the critical signal is never buried.
The Full Picture: Syscall To Risk Score In One View.
statool fires on process chain patterns, not just individual commands. A wget spawned by node via a bash intermediary is a fundamentally different signal from a user running wget in a terminal. statool sees the difference because the kernel sees the difference.
Risk levels — NONE, LOW, MEDIUM, HIGH — are computed per-event using a policy engine that evaluates binary name, spawn chain, destination IP, and port. Per-process statistics track connection counts, exec counts, first/last seen, and highest risk ever observed.
Your Build Has A Behavioral Signature.
An Attacker Cannot Forge It.
A fingerprint is the complete set of (process, destination) pairs from a known-good build. It captures exactly what binaries ran and where they connected. The attacker may control your dependency tree — but they do not control your baseline. Any deviation is an anomaly. The build fails. The alert fires.
Attacks that bypass static analysis do so because they occur at runtime. They execute code that was never in your repository. They connect to servers that were never in your allowlist. The only defense is runtime observation — and the only tamper-proof vantage point is the kernel.
Three API Calls. Any Pipeline. Any Language.
No agents in your containers. No Dockerfiles to change. No SDK to import. Works with Jenkins, GitHub Actions, GitLab CI, CircleCI, Buildkite — anything that can run curl.
- Run one good buildstatool records every exec and connect syscall. This becomes the behavioral baseline — the fingerprint of a clean build.
- Promote the fingerprintOne API call locks the baseline. Every future build is compared against it in real time at the kernel level.
- Deviations fail the buildNew binary? New outbound connection? Unknown IP? The build is flagged before it can exfiltrate data or persist to disk.
- Anomalies surface in insightsEvery CI/CD anomaly is automatically promoted to the AI insights feed with full process chain, hostname, and command-line context.
The postInstall Hook: Most Dangerous Five Bytes In Software
npm, pip, gem, cargo — every package ecosystem provides a mechanism for running arbitrary code at install time. It is the most powerful and least-scrutinised surface in modern software. SAST never sees it. SCA only knows about known-bad packages. statool instruments it at the kernel level. There is no hooking the hook.
Legitimate Domains As Cover: The New C2 Playbook
Modern attackers use Cloudflare Workers, AWS Lambda URLs, and GitHub Gists as command-and-control proxies. Every domain is legitimate. Every certificate is valid. Every URL filter passes it. statool does not care about domain reputation — it watches whether the connection was in the baseline. If it was not, the build fails.
Behavioral Defense: The Only Control That Catches What The Code Doesn't Show
A behavioral fingerprint cannot be forged without matching it exactly. The attacker would need their malicious build to connect to exactly the same servers, run exactly the same binaries — at which point the attack achieves nothing. statool makes the baseline the security control.
Watch Your First Build. Free.
Deploy in under 5 minutes. No kernel modules. No code changes to your pipeline.
Self-hosted. Jenkins, GitHub Actions, GitLab CI, CircleCI — all supported.