SysWarden is a host intrusion prevention system built entirely in Go and aimed at Linux servers in critical environments. It goes beyond alerting by enforcing automated CIS Level 2 hardening and blocking attacks at layers 2 through 7. At layer 2 it drops malicious MACs and rate-limits ARP; at layers 3/4 it applies stateful IP/CIDR/ASN/GeoIP filters and TCP-flag anomaly checks; at layer 7 it inspects HTTP traffic for brute-force attacks and payloads with a built-in WAF daemon named syswarden-core. The project also integrates global Threat Intelligence feeds—Data-Shield IPv4, GeoIP and ASN lists—so you can centrally sync bans across servers in high-availability clusters. Beyond classic HIPS, SysWarden doubles as a cloud workload protection platform. It secures Docker containers by inserting nftables/iptables chains at both network and application levels, mirroring enterprise agents like CrowdStrike but without kernel modules or shell scripts. On the web-app side, it embeds what the industry now calls WAAP: it watches decrypted proxy logs to catch SQLi, RCE, LFI, Docker API abuse or auth endpoint attacks in real time. It replaces Fail2ban by parsing access logs asynchronously with a memory-safe sliding window, and it ships telemetry—bans, alerts, SIEM messages—directly over TLS/UDP or to Discord/Teams webhooks. Everything runs in pure Go, no bash or system cron jobs. Firewall rules, systemd units and telemetry loops live in memory via os/exec wrappers and goroutines. Threat feeds parse with net.ParseCIDR to reject malformed data. Telemetry uses rsyslog UDS on Debian/Ubuntu or a systemd-journald/file-tail hybrid on RHEL/Fedora. You get a local TUI for monitoring, a CLI for install/update/uninstall, and packages in .deb or .rpm form. Supported distros include Debian 12/13, Ubuntu 24.04+, RHEL/AlmaLinux/Rocky 9+, Oracle 10+ and Fedora 40+. Installation is a three-step process: download the package and SHA256SUMS, verify with sha256sum, then install via apt-get or dnf.