Watch paint dry - Monitoring what doesn't change#

Ole Herman Schumacher Elgesem, Northern.tech (the company behind CFEngine and Mender)

• Why: A clever inversion of monitoring: alert on changes to things that should never change — DNS records, released-software checksums, tag commit SHAs, admin counts, unsigned commits — as a lightweight compromise-detection tripwire. It's a new open-source tool launch with a genuinely simple, transferable idea.
• What: The concept and open-source implementation (PostgreSQL-backed, modular) of monitoring invariants: anything whose change is itself the signal, tracked with full history so any change to a monitored variable raises an alert (from abstract only).
• How: Modular architecture with a PostgreSQL database tracking history and changes per monitored variable; new check modules are easy to add. Example invariants: number of script tags on your site, checksum of a release, number of org admins, your website's DNS/IP.
• Where applicable: Broadly applicable and lightweight — this pattern (change-of-invariant alerts) is orthogonal to, and composable with, existing monitoring, and is directly useful for supply-chain and account-takeover detection. Early-stage project from a talk launch, so expect rough edges.