OpenWatch

The Compliance Operating System. See Everything, Continuously.

---

An auditor asks: "Were these 200 servers compliant with STIG on January 15th?"

With manual processes, that question takes a week to answer. With point-in-time scanning tools, you can only answer it if you happened to scan that day. With OpenWatch, it is a query: answered in seconds, backed by machine-verifiable evidence, exportable as CSV, JSON, PDF or OSCAL.

OpenWatch is a continuous compliance platform for Linux fleets under CIS, STIG, NIST 800-53 and PCI DSS. It connects to your servers over SSH, runs the 769-rule Kensa corpus, and keeps posture as a timeline: what is passing now, what was passing last Tuesday, what drifted since your last assessment, and what needs attention before the next one. Read the introduction for what it does and how it is built.

Project status: Go rebuild, generally available. OpenWatch is a single Go binary that serves both the REST API and the embedded React UI (the original Python/FastAPI implementation was archived out of the repo on 2026-06-05). The Go tree lives at the repo root: Go 1.26 backend (cmd/, internal/), React 19 + TanStack frontend (frontend/), PostgreSQL-only. The current version is 0.8.0-rc.5, on the general-availability line that opened with 0.2.0.

Deploy in 10 minutes

Requirements: a Linux host (RHEL/Rocky/Fedora/Oracle or Ubuntu/Debian), PostgreSQL, and 4 GB RAM. No Docker, Podman, or containers are required.

sudo dnf install ./openwatch-*.rpm ./kensa-rules-*.noarch.rpm   # RHEL / Rocky / Fedora / Oracle
sudo apt install ./openwatch_*.deb ./kensa-rules_*.deb          # Ubuntu / Debian

sudo openwatch setup                   # provision PostgreSQL, migrate, create the admin, start

kensa-rules is the rule corpus; the openwatch package requires it. setup shows its plan and waits for confirmation before changing anything; the installation guide covers every option and the manual path.

Open https://localhost:8443 and sign in with the admin user you created.

Run your first scan

1. Add credentials: Settings > System Credentials > add your SSH user/key
2. Add a host: Hosts > Add Host > enter IP, select credentials
3. Scan: Click Scan on the host card

Results appear in under a minute. OpenWatch ships with the built-in Kensa rule corpus (the count per framework is kept in one place): human-readable YAML, not XML, ready to go.

Documentation

Start with the introduction: the problem, what OpenWatch does, how it compares, the architecture and the security model. Then three starting points: an operator reads Installation, then the Quickstart, then Scanning and compliance; an administrator reads User roles and the runbooks; a contributor reads AGENTS.md and CONTRIBUTING.md. The full index is docs/README.md.

Topic	Link
Introduction	docs/guides/INTRODUCTION.md
API contract	api/openapi.yaml (source of truth)
API guide	docs/guides/API_GUIDE.md
Full documentation	hanalyx.github.io/OpenWatch
Quickstart	docs/guides/QUICKSTART.md
Production deployment	docs/guides/PRODUCTION_DEPLOYMENT.md
Security hardening	docs/guides/SECURITY_HARDENING.md
Security policy	SECURITY.md (how to report a vulnerability, supported versions)
Behavioral specs (engineering SSOT)	specs/, registered in specter.yaml

Part of the Hanalyx Compliance Platform

OpenWatch is the compliance operating system: the dashboard, the scheduler, the governance layer. Kensa is the compliance engine underneath: 769 rules, 29 remediation mechanisms, automatic rollback, all over SSH.

If you want a CLI that integrates into scripts and pipelines, start with Kensa. If you want a platform for your team with a dashboard, scheduling, and audit workflows, start here.

Community

Have a question, idea, or want to share how you're using OpenWatch?

Join the Discussion

• Q&A: Get help with setup, scanning, and configuration
• Ideas: Propose features and integrations
• Show and Tell: Share your compliance workflows

Found a bug? Open an issue. Found a vulnerability? Email security@hanalyx.com as described in SECURITY.md, not a public issue.

Contributing

The Go tree lives at the repo root. make build builds the UI, embeds it and writes dist/openwatch; a bare go build ./... fails on a fresh clone because the server embeds a directory that only the build produces. make ci-local runs what CI runs.

make build             # Go 1.26 backend + React 19 frontend, one binary
make ci-local          # build, vet, tests, spec coverage, doc style

The legacy Python implementation is archived outside the repo and is no longer built or tested here. See CONTRIBUTING.md before submitting a PR.

License

OpenWatch is licensed under the Apache License 2.0 (see LICENSE and NOTICE).

• Free to use, modify, self-host, and redistribute under Apache 2.0.
• The compiled binary statically links the Kensa compliance engine, which is BSL-1.1, so a binary distribution is a combined Apache/BSL work (see NOTICE).

Third-party dependency licenses: THIRD-PARTY-NOTICES.md. Commercial inquiries: legal@hanalyx.com