SysWarden is a Go-based host intrusion prevention system that enforces CIS Level 2 hardening and integrates global threat intelligence to block attacks at network and application layers. It manages nftables/iptables rules, runs a memory-safe WAF daemon, protects container workloads, and provides real-time telemetry and HA clustering without resorting to shell scripts. It installs via standard .deb/.rpm packages on enterprise Linux and offers live alerts and a TUI dashboard.

• Written entirely in Go with no bash scripts or cron jobs—firewall rules, systemd units, and telemetry loops run via os/exec wrappers and goroutines instead of shell scripting.
• Enforces automated CIS Level 2 hardening and blocks threats across layers 2-7 (MAC/ARP filtering, IP/CIDR/ASN/GeoIP rules, TCP-flag anomaly detection, and a built-in WAF for HTTP-layer attacks like SQLi/RCE/LFI).
• Positions itself as a Fail2ban replacement (memory-safe async log parsing) and a lighter alternative to agents like CrowdStrike for container protection, since it avoids kernel modules entirely.
• Ships as native .deb/.rpm packages for major enterprise distros (Debian 12/13, Ubuntu 24.04+, RHEL/AlmaLinux/Rocky 9+, Oracle 10+, Fedora 40+) with SHA256-verified installation and a TUI dashboard for monitoring.