Live questions
Machines > Live questions asks every machine one question at once and shows the answers as they come back, usually within a few seconds, from the machines themselves rather than from the last scan. Use it when something just happened: a vulnerability in a library was announced, someone needs to know who is signed in to a server, or an auditor asks which machines have a port open.
Questions only read. Nothing on a machine is changed, and no question runs anything but its own read-only check.
The questions
| Question | You give | Each machine answers |
|---|---|---|
| Installed software | a name, for example openssl | the matching packages and their versions |
| Listening port | a port number, or nothing for all of them | whether it listens on the port, and which program |
| Signed in now | who is signed in, and since when | |
| Administrators | the accounts with administrator rights (Windows: the Administrators group; Linux: uid 0 and the sudo, wheel, and admin groups) | |
| Running program | a name, for example python | the matching processes |
| Service | a name, for example sshd or wuauserv | running or stopped, and whether it starts at boot |
| File | a full path | whether it exists, its size and date, and its SHA-256 (files up to 512 MB). Files only their owner can read (/etc/shadow, private keys) and Windows key stores are never hashed, because a hash would let someone check a guess at a secret; devices and pipes are never opened |
| Restart pending | whether the machine is waiting for a restart | |
| Uptime | how long it has been running |
Names may use letters, numbers, spaces, and . _ + - @; anything else is refused before it is sent.
The answers
The result says how many machines answered and how long it took, and lists machines that did not answer within 25 seconds (offline, or busy). Only machines that match narrows the list to the yes answers, and Download CSV saves every answer.
Who can ask
Admins and approvers, and other roles whose permissions include gardience_live.ask. A person limited to some node groups asks only their own machines, and choosing a group never reaches past them; a permission granted for some machines asks only those. Each question is written to the audit log with the person who asked, the question, and the machines it went to. While the audit log cannot be written (a full data volume), live questions wait, because a question nobody can see later is not asked.
Change alerts
Below the questions, Change alerts watches every machine for the changes that usually matter in an incident or an audit. When an admin turns it on, Gardience takes a read-only snapshot of each machine every 5 minutes (or 15, or 60) and compares it with the one before. It alerts, through the channels under Administration > Settings > Alerts (email, Slack or Teams, PagerDuty), when:
- a new administrator account appears (Windows: the Administrators group; Linux: uid 0, sudo, wheel, admin);
- a new port starts listening (ports below 32768: higher ones are temporary ports programs open and close all the time, and comparing them would bury the real alerts);
- a security service stops: Microsoft Defender, Defender for Endpoint, Windows Firewall, or the Windows event log; on Linux auditd, firewalld or ufw, ClamAV's updater, or the CrowdStrike, Defender, SentinelOne, or Sophos agent;
- a USB storage device is plugged in.
The first snapshot of each machine is only the starting point, so turning alerts on does not raise an alert for everything already there. Removed administrator rights and services running again are listed under Recent changes without an alert. Turning change alerts off forgets the snapshots, so turning them on again starts fresh. Turning them on or off is written to the audit log.
For CMMC, change alerts support monitoring systems to detect attacks and unauthorized use (3.14.6, 3.14.7) and controlling removable media (3.8.7), alongside your other monitoring.