Why atalince starts in Monitor only

When you install the agent, the server shows up in the dashboard within seconds, already sending events. But it doesn’t block anything. Every server starts in Monitor only, and that’s on purpose.

The number one risk is you

The most common way a blocking tool goes wrong isn’t letting an attack through. It’s blocking the administrator. A few wrong passwords, or a deploy script that opens lots of connections, and the rule that should protect the server locks you out.

That’s why the first step after installing is adding your IP, or the office network, to the allowed IPs. Allowed addresses are never blocked. The connected-server screen suggests this before anything else.

Know the noise before acting

Every server has its own background noise. A mail server gets login attempts all day. A public API gets probes for paths like /.env and /wp-login.php without ever having run WordPress. A CI server can look like an attack from the outside.

Watching for a while shows what’s normal there. You see which sensors are producing events, which sources keep coming back and whether something legitimate needs to go into the allowed IPs before you turn protection on.

Check the sensors are reading

The dashboard shows three signals per server: Communication, Sensor and Protection. In Monitor only, the Protection signal says “monitoring”. The other two should already be green.

If Sensor says “Not reading”, turning protection on won’t help: the agent isn’t seeing the logs, so it won’t detect anything to block. Fix the source first. On servers without /var/log/auth.log, for example, SSH is read from journald.

Turning protection on

With your IP allowed and the sensors reading, use Enable protection on the server page. From then on, the service sensors (SSH, web, mail, FTP and databases) request blocks, and each one goes through the verification trail.

The network detectors (port scans and floods) and the integrity detector keep recording only, even with protection on. They’re useful signals, but easy to trigger by mistake, and an automatic block based on them would do more harm than good.

A short checklist

1. Install and confirm the server showed up.
2. Add your IP to the allowed list.
3. Let it watch for a few hours, or a day if the server is critical.
4. Check that Communication and Sensor are green.
5. Turn protection on and follow the first blocks through the trail.

The full guide is in First steps.