LemonSees v3.0.0

Changelog

v3.0.0 — LemonSees by Altumptic

Brand & design

• New identity: LemonSees by Altumptic, new lemon-eye logo, icons regenerated for all platforms.
• Anthropic-inspired design system: warm Ivory (default) and Graphite themes, Source Serif 4 display type,
  DM Sans UI, JetBrains Mono for data — all self-hosted (no network fonts).
• Comfortable UI scale by default (110 %) with presets up to 140 %.

Product

• Functional top bar: clickable breadcrumbs with menus, global host switcher, alerts inbox, quick create, live status,
  theme toggle, app menu (language, demo, shortcuts, about).
• Command palette (Ctrl K) and g-shortcuts; shortcuts reference (?).
• SOC analytics page: alert volume by severity, MTTA/MTTR, activity heatmap, affected hosts, analyst workload.
• MITRE ATT&CK matrix with automatic technique mapping and drill-down.
• File integrity monitoring (FIM) over SSH with baselines; drift auto-creates incidents.
• Charts everywhere: overview, incidents, compliance by framework, vulnerabilities radar, hardening radar,
  connections, persistence, containers, endpoint trends, audit activity; dotted world attack map.
• Demo mode with realistic data (localised).

Settings that actually work

• Auto-refresh for scan pages, desktop notifications for new critical incidents, 24-hour clock, sidebar default.
• SOC engine: threat-sweep interval, audit retention, downtime notifications, auto-incidents.
• Backup export / settings import; About section with security contacts.

Platforms & security

• Web mode with token authentication (LEMONSEES_TOKEN), refuses to bind publicly without a token; security headers.
• Portable Windows .exe (+ zip) and Linux AppImage / tar.gz; portable data folder next to the executable.
• Dockerfile, CI and tagged release workflow.
• /.well-known/security.txt and SECURITY.md with Altumptic PGP key.

Performance

• Lazy-loaded pages and demo engine, idle prefetch, vendor chunk splitting, de-duplicated live state updates.

🍋 LemonSees v2.0.0

🍋 LemonSees v2.0.0

Agentless SOC platform for L1/L2/L3 analysts — SIEM/XDR · EDR · NDR · CTI · SOAR · GRC over SSH. Each host is a managed endpoint where the SSH session is the agent — nothing is installed on your servers.

Design

• BetterStack-inspired UI — deep-charcoal surfaces with soft depth, tabular metrics, subtle brand glow. Clean light + dark themes. Design system documented in DESIGN.md.
• Cloudflare-style navigation — sections → nested sub-tabs, one compact page header per screen, centered content.

Modules

• EDR — live process table (CPU/MEM/uptime) and persistence view (cron, systemd services, timers, startup).
• NDR — full connections view (established + listening + owning process) alongside live traffic.
• CTI — threat intel with attack geo-map, and IP investigation (geo · rDNS · WHOIS · attacker cross-check).
• SOAR — incident register + playbooks incl. the auto-incident brute-force rule.
• Uptime — HTTP monitors, status board, and desktop downtime notifications.
• Metrics — per-host CPU/mem/disk/net/connections history charts.
• SIEM — remote log viewer with severity summary + event histogram.
• GRC — CIS/NIST/ISO compliance, standards reports, audit log.
• Databases — 39 engines (query · browse · REST console).

Install

1. Download LemonSees-v2.0.0-win.zip below.
2. Extract and run LemonSees.exe. Close the window — everything stops, no background services.

The engine binds to 127.0.0.1 only. Optional geo-IP sends only attacker/peer public IPs to a geolocation service; everything else stays local.

SHOK v1.5.0

SHOK v1.5.0

Vulnerability analysis (cyber)

• Configuration & exposure scan over SSH: SSH hardening, firewall, pending security patches (CVE risk), permissions, accounts, exposed DB ports
• Each finding includes remediation and hardening index with coverage checkbars per category

Live traffic monitoring

• rx/tx throughput from /proc/net/dev, active connections
• Top remote peers with geo-IP and live sparklines

Standards reports (GRC)

• One-click report consolidating posture + compliance + vulnerabilities + threats + incidents
• Mapped to CIS / NIST / ISO 27001 / GDPR with downloadable HTML

Visual identity

• New logo, bolder look, accent glows, 16 color themes

Carried from v1.4

• Threat intel + geo-IP, auto-incidents, security posture, compliance, audit, 39 databases — all agentless over SSH

Download

• SHOK-v1.5.0-win.zip — extract and run \SHOK.exe\
• Windows 10/11

SHOK v1.4.0 — SOC & GRC Platform

SHOK v1.4.0 — SOC & GRC Platform

SOC (Security Operations)

• Dashboard — fleet KPIs, risk per host, posture ring, recent incidents
• Security posture — risk score, SSH hardening, failed logins, open ports, pending updates
• Threat Intel — live auth.log/journald analysis (20s refresh), geo-IP of attackers, top IPs/countries/targeted usernames
• Incidents — severity, status workflow, timeline, host linkage
• Auto-incidents — background monitor creates incidents when brute-force thresholds are exceeded (configurable in Settings)

GRC (Governance, Risk & Compliance)

• Compliance — 15 auto CIS/NIST controls (SSH checks) + 8 manual governance controls with attestation
• Audit log — immutable action journal with search and CSV export

Design system v2

• Grouped navigation: Panel · Monitoring · Security · SOC · Management · GRC · System
• KPI tiles, score rings, severity badges, drawer panels, risk color tokens
• Acrylic glass window, brand subtitle SOC · GRC

Also included (from previous releases)

• Real metrics collector, 39 database engines, SQLite WASM, i18n (5 languages), 6 themes

Privacy

• Geo-IP sends only public attacker IPs to a geolocation service (toggle in Settings)
• Engine listens on \127.0.0.1\ only; config in %APPDATA%\SHOK\config\\

Download

• SHOK-v1.4.0-win.zip — extract and run \SHOK.exe\
• Windows 10/11

SHOK v1.2.1

SHOK v1.2.1

Metrics fix

• Rewritten collector — CPU computed from two /proc/stat\ reads in a single SSH call
• Live-tested: per-host CPU, RAM, load, and uptime are accurate and distinct

SQLite

• No \sqlite3\ required on the server
• .db\ files fetched over SSH, opened locally with WASM (read-only browse)

Database hub (39 engines)

Full support: PostgreSQL, TimescaleDB, CockroachDB, YugabyteDB, QuestDB, Redshift · MySQL, MariaDB · Redis, KeyDB, Valkey, Dragonfly · MongoDB · SQLite

REST console: Elasticsearch, OpenSearch, CouchDB, ClickHouse, Meilisearch, Typesense, Qdrant, Weaviate, Chroma, ArangoDB, InfluxDB, Prometheus

Coming soon: MS SQL, Oracle, Cassandra, ScyllaDB, Neo4j, Memgraph, Memcached, Milvus

Cloud (vendor API — not over SSH): DynamoDB, BigQuery, Snowflake, Firebase, Firestore, Pinecone, Neptune

UI

• Categorized engine picker, tabs per DB type, Find on server auto-discovery
• Acrylic glass window, glow accents in Settings
• Version badge in sidebar

Download

• SHOK-v1.2.1-win.zip — extract and run \SHOK.exe\
• Windows 10/11

SHOK v1.1.0

SHOK v1.1.0

New in this release

• Settings page — switch language (UK, EN, RU, PL, ZH) and theme (6 color schemes)
• English README — full documentation in English
• Contributors — project credits section

Download

• SHOK-v1.1.0-win.zip — extract and run \SHOK.exe\
• Requires Windows 10/11

Features

• Live CPU, RAM, disk monitoring over SSH
• Docker containers, networks, volumes management
• Built-in SSH terminal
• No background services — close the window, everything stops

Security

We recommend SSH keys instead of passwords.

SHOK v1.0.0

ШОК v1.0.0 — перший публічний реліз

Що це

Десктопна програма для моніторингу Linux-серверів і Docker по SSH — без агентів.

Завантаження

• SHOK-v1.0.0-win.zip — розпакуй і запусти \SHOK.exe\
• Потрібен Windows 10/11

Можливості

• Моніторинг CPU, RAM, диску наживо
• Управління Docker-контейнерами, мережами, томами
• Вбудований SSH-термінал
• Без фонових служб — закрив вікно, все зупинилось

Безпека

Рекомендуємо SSH-ключі замість паролів.