ET Ducky is in Product Hunt's Hypership challenge on Wednesday, September 30. I'll read every feature request in the launch comments and ship what I can that day.
The agent reads the kernel event stream on Windows (ETW) and Linux (eBPF), and every alert gets a root-cause analysis built from those events. Remote desktop, patch management, behavioral security, and reports run from the same agent.
What's missing from the RMM you use today that a kernel event stream could answer? Post it here or in the launch comments tomorrow.
ET Ducky Local-First runs the whole RMM on your own infrastructure with Docker Compose, with unlimited seats and technicians at one flat price. It isn't completely air-gapped. Sign-in goes through Clerk, and the license renews against etducky.com.
If you run an RMM on your own hardware, which outbound connection would fail your security review? Is the sign-in path or the license check the harder one to get approved?
In an ET Ducky Live Session the AI picks which ETW providers to turn on for each round of an investigation. Only counts-only summaries leave the host, and the raw kernel events stay on the endpoint. You can use your own Anthropic or OpenAI key on any tier.
Guided Troubleshooting works the other way. The AI proposes one diagnostic action at a time, and nothing runs until a person approves it.
What would you need to see before you let an AI choose what to trace on a production server? Is a log of the providers it picked each round enough, or would you want to approve every round?
