Onshore Crescent
Your servers already record every failed login, every exploit probe and every crashing service. Nobody reads those logs. Crescent does: it collects them, spots the attacks and failures that matter within minutes, blocks attacking addresses on its own, and emails a person who can deal with it in one click.
What It Found on Day One
Before offering Crescent to anyone, we pointed it at our own fleet: 1.33 million log events from two servers in 24 hours. It found problems that had been going on, silently, for days.
A Tunnel Failing for Nine Days
A database tunnel had been refusing to connect because a remote host key changed — about 170,000 restarts, every five seconds, with nothing alerting anyone.
8,000 Password Guesses a Day
A public file-intake service was taking thousands of guesses daily from attackers whose real addresses were hidden behind a proxy. None succeeded; now they get blocked.
Certificates Not Renewing
Scheduled certificate renewals for three sites were failing quietly, weeks before anyone would have seen a browser warning.
From Log Line to Action
| Step | What Crescent Does |
|---|---|
| Collect | A small agent on each Linux server reads the system journal and the log files you choose, strips passwords, keys and tokens on the server, and sends compressed batches over HTTPS. If the link drops, nothing is lost — it resumes where the last confirmed batch ended. |
| Detect | 23 detection rules covering SSH and sudo abuse, break-ins (repeated failed logins followed by a success), account changes, web exploit probing, sensitive files served over the web, firewall scans, restart loops, disk and memory exhaustion, crashes and failed services. Thousands of repeats become one detection with a count, not thousands of alerts. |
| Respond | Addresses caught attacking are blocked automatically at the network edge for 24 hours, with a one-click Unblock if it was a scanner you run. |
| Notify | An email with the evidence, plain-language advice, and buttons to Acknowledge, Accept the risk, Ignore for a while, or Escalate — no login needed to act. Critical findings go to your escalation contacts at once; anything nobody acts on escalates on its own. |
| Report | A daily summary of every address blocked and every serious detection still open — sent even on a quiet day, because silence proves nothing. |
Built the Way a Small IT Team Needs It
Live View
A live dashboard of event rates per server, a running tape of detections, and search across all your logs.
Readable Agent
The collector is plain Python with no third-party dependencies, runs as an unprivileged user, and only reads logs — your administrator can read every line before installing it.
Secure Sign-in
Per-organization accounts with two-factor authentication and recovery codes. Every decision on a detection is kept in an append-only log of who did what, and when.
Hosted or On Your Own Server
Use Crescent hosted by Onshore, or have Onshore install the same software on a server you own, so your security data never has to leave your environment.
See What Your Logs Have Been Trying to Tell You
We'll connect Crescent to a few of your servers and walk through what it finds in the first 24 hours. Most environments have at least one problem nobody knew about.
Book a Crescent WalkthroughWho It's For
Small & Mid-Sized Businesses
Real security monitoring without a security operations center or an enterprise SIEM bill.
Defense Contractors & Regulated Firms
Organizations that need security logs collected, reviewed and acted on — and may prefer to keep them on their own infrastructure.
Managed Service Providers
One place to watch many clients' servers, with separate users and alerts for each organization. Multi-client monitoring is in early access — ask us about it.
Pricing
Priced by the number of servers Crescent watches. Every plan includes the agent, all 23 detection rules and email alerts you can act on in one click, and Onshore sets it up and runs it for you.
Starter
Up to 3 servers
$999 / first year
$599 / year to renew
- Hosted by Onshore
- Linux agent and 23 detection rules
- Email alerts with one-click actions
- Daily attack summary
- 30 days of log search
- Standard support
Business
Up to 25 servers
$4,999 / first year
$2,999 / year to renew
- Everything in Starter
- Automatic attacker blocking, set up by Onshore at your edge
- Escalation contacts and repeating critical alerts
- 90 days of log search
- Priority support
Enterprise
Unlimited servers
Custom
Annual contract
- Everything in Business
- Installed on your own server
- Multi-client monitoring for MSPs (early access)
- Dedicated onboarding and support
Prices are per year, billed at purchase by card or PayPal. After you buy, we contact you to set up your account and connect your first servers. Enterprise is arranged directly with our team.