Follow these five steps to get SYSMarshal protecting your Windows Server within minutes.

SYSMarshal includes 17 integrated features. Click any card to jump to its full documentation.

The beating heart of SYSMarshal. A continuous monitoring loop that reads Windows event logs, identifies IP addresses that have exceeded your attack threshold, checks them against a global reputation database, and instructs Windows Firewall to block them — all automatically, with no human involvement required.

Configurable Parameters — adjust these in Settings to match your environment's risk tolerance:

SYSMarshal reads directly from Windows Security and Application event logs using the Windows Event Log API, monitoring specific Event IDs and extracting attacker IP addresses from those events.

Default monitored events — active from the moment you install SYSMarshal:

Before blocking any IP, SYSMarshal checks it against a central cloud reputation database shared across all SYSMarshal installations worldwide. This prevents false positives and enriches every block decision with a confidence score.

Abuse Confidence Score — every blocked IP is tagged with a score from 0–100, colour-coded for instant threat assessment:

Every IP action is automatically geo-located and stored. This data is used in the desktop application for interactive maps, and embedded in your email reports to provide immediate geographic context on every threat.

In-app map: Clicking any row in the Baseline or Recent Activity grid renders a live Google Maps panel directly inside SYSMarshal — no browser required.

Email maps: Reports include a static Google Maps image embedded in the email body, with red markers at each blocked IP's location, auto-centred on the average geographic position of all current threats.

Two independent protection mechanisms ensure that legitimate IPs are never blocked: your Whitelist (manually defined) and Trusted IPs (automatically populated via the reputation API).

When you save a new whitelist entry, SYSMarshal automatically removes that IP from the firewall block rule if it was previously blocked. On every scan cycle, the whitelist is checked before any banning decision is made.

SYSMarshal sends professionally formatted HTML security reports to any number of recipients — delivered via the SYSMarshal Cloud Mail Service. No local SMTP server or email configuration is required.

What's included in every email report:

Windows Firewall block rules have a practical limit of around 10,000 IP entries. SYSMarshal monitors this capacity and automatically manages it so there is always room to block new threats — without requiring any manual intervention.

A separate, lightweight Windows service (SYSMarshal.Watchdog) that runs independently from the main SYSMarshal service. Its job is to monitor whether SYSMarshal itself is running — and to alert you immediately if it stops.

Secondary function: The Watchdog also restores the required Windows Audit Policy settings once every 24 hours using AuditPol /restore — ensuring SYSMarshal always has the correct events flowing from Windows even if another tool or user has changed the policy.

The Baseline screen shows a live feed from the SYSMarshal Central Database — a globally shared list of IP addresses flagged as malicious by SYSMarshal installations around the world. This gives you proactive intelligence about threats that haven't attacked you yet.

Proactive blocking: Select one or more IPs from the Baseline grid and immediately add them to your local Windows Firewall block rule — even if those IPs haven't yet attacked your server. Protect yourself based on the global community's experience.

An integrated chat interface backed by a large language model hosted on the SYSMarshal cloud. Ask security questions in plain English — no SQL knowledge or Windows expertise required. The AI uses your actual local security data as context.

An investigation tool that helps you understand exactly what is happening in your Windows event logs — especially useful when setting up SYSMarshal for the first time, or when tuning it for your specific environment.

SYSMarshal includes a built-in report engine and a live status bar dashboard that updates every 10 seconds.

All reports can be exported to PDF, XLS, DOCX, HTML, or printed directly from the built-in report viewer.

Live Status Bar — updates every 10 seconds, visible at the bottom of the SYSMarshal application at all times:

A live snapshot of all open TCP and UDP ports on your server — similar to running netstat, but presented in a clean, filterable grid for quick network exposure assessment.

What it shows: TCP listeners, UDP listeners, the local IP each port is bound to, and the port number and protocol. Access it via the "Chk Open Ports" shortcut in the status bar.

Use cases: Identify unexpected open services, confirm which port RDP is listening on, and discover ports that may be unnecessarily exposing your server.

SYSMarshal uses an API key combined with your machine's hardware fingerprint (BIOS serial number) to validate and enforce its subscription. The desktop application manages the service lifecycle directly.

Choose the tier that fits your needs:

SYSMarshal includes a lightweight Patcher (Patcher.exe) that checks for new versions on every startup and applies them automatically — keeping you protected with the latest threat intelligence and feature improvements.

SYSMarshal depends on Windows Security Auditing to generate the event log entries it monitors. If audit policies are disabled — accidentally or deliberately — key Event IDs stop appearing in the logs, and SYSMarshal cannot detect attacks.

To protect against this, SYSMarshal ships with a pre-configured Audit Policy file (POL_MMC\policy.csv). On every application launch and every 24 hours via the Watchdog, SYSMarshal runs:

A full data browsing interface built into SYSMarshal. Gives administrators direct read access to all data in the local SQL Server database — without needing SQL Server Management Studio or any external tool.

In-app actions available from the Recent Activities view: