Ferris · Managed monitoring · Endpoint console
Ferris is the white-label operations stack we deploy at customer sites. One host, one configuration file, and every machine, service, certificate and printer on the site is watched all night, with a portal your customer understands.
Why it exists
Ferris watches every machine, service and certificate at a site, so nobody has to notice a failure by hand. Three situations it gets bought for.
TodayNobody renews a certificate they have forgotten. The shop's checkout stops on Saturday morning, the customer calls you on Monday, and the outage is already two days old.
With FerrisThe expiry is flagged twenty-one days out, then again at seven, on the phone of whoever is on call.
What you gain — a weekend that never becomes an incident, and renewals that stop depending on someone's memory.
TodayThe ERP server runs out of disk overnight. Production is stopped for three hours while a technician drives to the site to find out why.
With FerrisThe trend crosses the line hours before the disk is full, and a script you approved beforehand can clear the logs on its own.
What you gain — an e-mail in the morning instead of a stopped site, and a call-out you did not have to make.
TodayA monitoring retainer is invisible. A month where nothing broke looks exactly like a month where nothing was done, and that is the month the client wants to renegotiate.
With FerrisOn the first of the month the client receives a PDF under your brand: uptime, incidents, patches installed, certificates renewed.
What you gain — the renewal conversation is over before it starts, because a quiet month is written down.
Bought by MSPs who look after other people's sites, and by internal IT teams who would rather find out first. There is no per-endpoint licence and no per-technician seat: the bill does not grow every time your client hires someone.
The tour
Three minutes at a fictional customer site: an alert arrives and is triaged, a machine heals itself, patches get approved without guesswork, and the month closes with a report the client can read. Watch it as the client would.
The console
A white-label portal with roles, quotas and shared scopes. Fourteen modules today, all on the live surface.
Site health at a glance: what is up, what is down, what is about to expire, what changed since yesterday.
Acknowledge, silence, browse the history. Bind an alert to a vetted script and let the site heal itself.
Real topology from discovered networks, hosts and their guests, then floors, rooms, switches and cabling drawn where they actually are.
Master-detail inventory with live gauges, OS and type badges, hardware, software and CVE-aware patch status.
Scan, dry-run, approve or deny by policy (all, security-only, approved list), then a compliance board that tells the truth.
Per-OS scripts with progress and results; read-only live views of services, processes and event logs.
Jobs that run when the shop is closed. Windows that mute what is expected and flag what is not.
Printers, switches, UPS, NAS and access points without an agent. A periodic sweep of the LAN feeds an unknown-device inbox.
A per-site knowledge base, linked from every machine and alert, written for the technician on duty.
Native ticketing: alerts open tickets, customers follow them in the same portal. No paid third-party modules.
Zero-touch: a USB autoinstall key or a one-line script enrolls a machine in metrics, inventory and, if sold, the SIEM.
Availability, incidents, patches, CVEs, TLS expiries — a PDF in English or French, scheduled and e-mailed under your brand.
Alert triage and script generation, with the Claude API or a local model. Only compacted figures leave the site, never logs or credentials.
Self-hosted remote desktop for technicians, unlimited sessions, no seat licence.
What Ferris watches
Built on battle-tested open-source components, wired together so a junior technician can run it and nobody can be locked in.
CPU, memory, disk with 24-hour prediction, inodes, load, reboots, failed units, clock drift. Twenty-plus rules validated before every reload; severity routing to Telegram, e-mail or webhook.
HTTP, TCP, SMTP and IMAP checks from inside the site, certificate expiry at 21 and 7 days, slow-response detection.
Linux, macOS and Windows agents: inventory, installed software, patch status with CVE awareness, remote scripts, live queries.
SNMP for switches, printers, UPS, NAS and access points; FortiGate metrics over its API; LAN discovery with an unknown-device alert.
The host watches itself: config reload failures, unreachable alert routing, storage nearing retention. Backups by snapshot, not by copying a hot database.
SIEM, file-integrity monitoring and intrusion detection as the SOC tier, deliberately separate: security owns the security numbers, management owns the fleet numbers.
Tiers
No per-technician seat, no per-endpoint licence, no tier-gated limits on retention, sessions or reports.
Metrics, alerting, probes, dashboards, the console, monthly report. What every site gets.
Agents on every workstation and server: inventory, patch approval and compliance, scripts, live tools, remote support.
SNMP devices, FortiGate metrics, LAN discovery and the unknown-device inbox.
Per-site knowledge base and runbooks, native ticketing with the customer portal.
SIEM, file-integrity monitoring, intrusion detection and the security report. Sold separately because it carries real cost, and real value.
Deployment
Written so that a human or an automated agent can install it without prior knowledge of the stack. We follow it ourselves, every time.
A small Linux host or container at the site. Everything binds to localhost behind a TLS proxy; nothing is published on the open network.
Site name, alert channel, retention, tiers: a single .env. Targets are plain files, reloaded in thirty seconds without a restart.
Bootstrap installs the runtime; deploy validates every rule and route first and refuses to touch what is running if anything is wrong.
Before we leave: take an agent down and watch the notification land on a real phone. Then hand over the runbook.
Frequently asked
Request a demo
Tell us how many sites and endpoints you run and which alerts wake you up today. We reply with questions, then a written proposal.