Every syscall.
Every packet.

A real-time, searchable, hash-chained stream of everything happening inside your staging container. eBPF at the kernel. Webhooks at the edge. Streaming JSON over a long-lived HTTPS connection.

✓ Real-time streaming ✓ Hash-chained ✓ SIEM exportable
Start free View event schema →
Log specStreaming
TransportHTTPS long-poll + WS
FormatJSON-ndjson
Event classes14
Median latency87 ms
Retention · free24 h
Retention · pro30 days
Hash chainPer-site · SHA-256
ExportSplunk · Datadog · S3
WebhooksSigned · retried 3×
01 · Live stream

A window into every container.

acme-shop.com · staging-a1b2c3 · tail -f
247 evt/minchain OK
14:22:09.417PLUGINactivated: akismet · v5.3.2 · admin:1
14:22:09.482SYSCALLopen("/var/www/html/wp-config.php", O_RDONLY) = 4
14:22:09.517SYSCALLconnect(api.akismet.com:443, tcp) = 0
14:22:09.891HTTP→ POST api.akismet.com/1.1/verify-key · 200 · 142ms
14:22:11.204DBUPDATE wp_options SET option_value=<redacted> WHERE option_name='akismet_api_key'
14:22:14.087ALERTegress blocked · 185.220.101.47:443 · policy:tor-exit-list
14:22:14.421FSwrite /var/www/html/wp-content/plugins/suspicious/phone-home.log · 17 bytes
14:22:17.002USERadmin:1 opened /wp-admin/options-general.php
14:22:19.334SYSCALLfork() = 2847
14:22:19.341DBSELECT * FROM wp_posts WHERE post_status='publish' LIMIT 10
14:22:21.118HTTP← GET /wp-admin/admin-ajax.php · 200 · 34ms
14:22:23.872CHAINblock sealed · e7d108f5…9a3b71f5 · 247 events
02 · Event schema

JSON in. JSON out.
Pipe it where you want.

Example event · SYSCALL.connect
{
  "v": 1,
  "ts": "2026-04-23T14:22:09.517Z",
  "class": "syscall",
  "type": "connect",
  "site": "a1b2c3",
  "container": "ctr_8f9a2b",
  "pid": 2841,
  "exe": "/usr/sbin/php-fpm8.2",
  "args": {
    "dst": "172.67.88.12",
    "port": 443,
    "proto": "tcp",
    "hostname": "api.akismet.com"
  },
  "result": "allow",
  "policy": "egress-allowlist",
  "chain_id": "e7d108f5..9a3b71f5",
  "seq": 9284
}
14 event classes

Every event carries a stable schema version, a timestamp, and a sequence number that chains into the site's running hash. Drop events into Splunk/Datadog unchanged — or filter to just the ones you care about.

syscall
http
db
fs
user
plugin
theme
cron
alert
quarantine
chain
lifecycle
backup
restore

Watch the container think.

Free tier includes a live terminal. Pro adds webhooks, SIEM export, and 30-day retention.

Start free All features →