Titan Shield — Autonomous Security Monitoring
A security monitoring system that scans authentication logs, ports, file integrity, and Docker events every 30 minutes — with a Telegram alert watchdog.
Problem
A public-facing VPS needs constant security vigilance. Manual checking doesn’t scale — and silent failures are the worst kind.
Solution
Titan Shield: a cron-driven security monitor that runs every 30 minutes:
- Auth log monitoring — failed SSH attempts, unusual patterns
- Port scanning — unexpected open ports flagged against an expected set
- File integrity — detects unauthorized modifications
- Docker events — container activity anomalies
- Alert watchdog — silent when clean, Telegram alert on real issues
Architecture
cron (*/30) → titan-shield → checks (auth, ports, files, docker)
│
├── .vault/titan-shield.log (append-only)
├── .vault/titan-alerts.jsonl (severity-tagged)
└── titan-shield-alert (watchdog → Telegram, silent when clean)Key decisions:
- Watchdog pattern: no output = no message (never spam)
- Expected-port allowlist — anything else is flagged
- Logs in
.vault/(protected, not world-readable)
Live Evidence
| Metric | Result |
|---|---|
| Scan frequency | Every 30 min |
| Alert log entries | 430+ |
| False alerts after fix | 0 (silent = clean) |
Learnings
- Silence is a feature. A watchdog that only speaks when needed respects attention.
- Expected-state lists beat anomaly heuristics. Knowing what SHOULD be open makes finding what shouldn’t trivial.
- Test alerts must be cleaned up. A future-dated test alert kept firing — the fix was deleting it, not changing the system.
Self-Critique
- No integration with fail2ban’s block log yet
- Host-level only — cloud firewall rules (Hetzner) checked manually
- Alert severity classification could be smarter
Evidence References
- Script:
/root/.hermes/scripts/titan-shield - Alert log:
/root/2nd-brain/.vault/titan-alerts.jsonl