Not “who logged in.” Who’s here. Watching. Now.
Authentication is a single moment. Presence is continuous — and nothing checks the gap. GiraffeEYE is an OS-level agent that proves a real person, on an enrolled device, is present for every request. The instant that stops being true, the session dies.
Auth tells you who logged in. Then it stops asking.
Every traditional system answers one question at login — and trusts that answer for hours. Here’s what walks straight through that gap.
curlOne OS-level agent. Four continuous proofs.
Not a plugin, not a browser extension — a privileged daemon on every workstation (Ubuntu, AlmaLinux, Windows), AV-whitelisted and running at about 0.3% CPU.
Hardware fingerprint
CPUID, board serial, GPU, MACs and disk — an identity that can’t be copied to another machine.
Rotating token
An HMAC-SHA256 / Ed25519 signature that rotates every 15 seconds. The secret never leaves the device.
Live heartbeat
A heartbeat every 5 seconds while the tab is active. Stream stops for 10s → session killed.
Traffic + DNS capture
Socket-level, process-bound capture of everything leaving — including DNS-tunnel detection.
A fingerprint that expires every 15 seconds.
The hardware secret never leaves the device — only a short-lived signature is transmitted. Capture one and it’s useless before you can use it.
Attacker grabs A81F4C9E at T+0 and replays at T+20. The server already expects F0AA218D. Mismatch → 401. Replay is dead on arrival.
Not just “who logged in.” Who is watching, now.
The agent sends a heartbeat every 5 seconds while the tab is active. No stream, no session. The moment it stops — a closed tab, a killed agent, a walk-away — access is revoked in under ten seconds.
Every request requires all three at once: enrolled device, current-window token, and a live heartbeat.
Three proofs. Required simultaneously. Always.
A curl request has no heartbeat. A replay has no valid token. A wrong device has no matching fingerprint. Every vector that beats traditional auth is stopped cold.
TAB_ACTIVE. No heartbeat stream.A81F4C9E at T+0, used at T+20. Server expects F0AA218D.fp_attacker. Enrolled device is fp_9c4a./api/eye/presence — token expired or from the wrong device.What nothing else on your stack does.
MFA, EDR and device-trust each own a slice. GiraffeEYE ties hardware, a rotating secret and live presence into one continuous check.
| Capability | MFA / SSO | EDR | Device trust | GiraffeEYE |
|---|---|---|---|---|
| OS-level hardware fingerprint (not browser) | no | partial | device cert | CPUID+board |
| Rotating 15s cryptographic token | no | no | no | HMAC/Ed25519 |
| Continuous heartbeat — session dies without it | no | no | no | every 5s |
| curl / replay blocked without a running agent | no | no | mTLS only | always |
| DNS tunnel / exfiltration detection | no | yes | no | entropy+rate |
| 100% on-premises · zero cloud | no | varies | varies | always |
Questions, answered.
No. It’s a privileged OS-level daemon that runs on the workstation itself — Ubuntu, AlmaLinux and Windows. That’s what lets it read real hardware identity and bind traffic to a process, which no browser extension can do.
The tab loses focus, TAB_INACTIVE fires and heartbeats stop. After a 10-second gap the session is terminated automatically — so an open tab on an unattended machine is no longer a way in.
The device secret never leaves the machine; only a signature valid for the current 15-second window is transmitted. A captured token is rejected as soon as the window rolls over, so replay from another host is dead on arrival.
The agent runs at roughly 0.3% CPU and is AV-whitelisted. Heartbeats and token rotation are tiny, and traffic capture happens at the socket layer without proxying the connection.
Entirely on-premises. GiraffeEYE correlates identity, device, presence and traffic inside your network and forwards events only to systems you already run — Wazuh SIEM, CRM webhooks, your dashboard. Zero cloud dependency.
Prove presence, not just login.
See GiraffeEYE kill a replayed session live. Book a walkthrough with the Giraffe team — deployed entirely inside your own network.