Syspeace is an intrusion prevention system designed to protect Windows servers from brute-force, dictionary, and other unauthorized access attempts. The system functions by monitoring Windows Security Audit event logs for failed login events to identify malicious attack patterns. Upon detection, it utilizes the Windows Filtering Platform (WFP) to automatically block the originating IP address for a configurable duration, dropping the connection.
The system employs a distributed relay architecture, enabling administrators to manage multiple server deployments from a central console without requiring direct line-of-sight or firewall alterations. All communication between the management console and server services is secured using TLS encryption, Diffie-Hellman key exchange, and a custom Public Key Infrastructure (PKI). Syspeace aggregates anonymized threat telemetry from its user base to distribute a preemptive global blocklist, and supports a floating license model, granular role-based access control, and nested rule logic for customized threat mitigation.
