Exporter on Mi&Bee Blog

From Compliance to Real-Time Defense: The Evolution of security-collector-exporter

Thu, 21 May 2026 00:00:00 +0000

The Origin: Compliance Check Hassles

Anyone in operations knows there’s no escaping one hurdle for domestic servers: Cybersecurity Level Protection (GB/T 22239-2019, commonly known as “Level Protection 2.0”). Whether you’re Level 3 or Level 2, auditors come asking about these things:

Is SSH root login disabled? Are password policies compliant?
Is the firewall on? Is SELinux enforcing?
Are there expired accounts? What’s the password validity period?
Which ports are open? Are there high-risk services running?
Are audit logs enabled? How long are they retained?

There are plenty of compliance check tools on the market—search GitHub and you’ll find a bunch: Golin, EvaluationTools, Linux-Security-Compliance-Check, etc. But they all share one limitation: Run once, get a report, done. You check compliance today, and someone changes sshd_config tomorrow, turns off the firewall, installs a backdoor service—you’d never know.

security-collector-exporter v0.3.0: Real-Time Security Monitoring with eBPF

Tue, 19 May 2026 00:00:00 +0000

From Static to Real-Time

The previous article introduced security-collector-exporter v0.1.0 — turning Linux security configuration states into Prometheus metrics. But v0.1.0 is essentially “snapshot-based”: periodically reading /etc, /proc, capturing the static configuration at a single point in time.

There’s an area of security operations that snapshots can’t cover: real-time security events. Someone running a reverse shell, a process escalating privileges, an abnormal network connection, someone loading a kernel module — these events happen and pass; you’d never see them at your next scrape.

security-collector-exporter: Monitoring Linux Security Auditing

Thu, 14 May 2026 00:00:00 +0000

Why This Was Built

Anyone managing servers has probably had this experience: compliance audit comes, SSH into machines one by one to check—SSH config correct, SELinux enabled, firewall running, any expired accounts, password policies compliant. A few machines are fine; dozens or hundreds becomes purely manual grunt work.

And the more painful part: none of this has continuous monitoring. You check compliance today, someone changes a config tomorrow, and you’d never know.