Launching today

ET Ducky

Launching today

RMM with kernel-level root cause analysis

2 followers

RMM with kernel-level root cause analysis

2 followers

•

•

ET Ducky is an RMM for Windows and Linux that reads the kernel event stream on every endpoint (ETW on Windows, eBPF on Linux). Every alert gets an automatic root-cause analysis backed by the kernel events that caused it. Remote desktop, patch management, behavioral security, automations, and natural-language reports run from the same agent at every tier. Start on the Free query tier with your own AI key, or take a 30-day trial with 1,000 AI queries and 20 agent seats, no credit card required.

Free Options

Launch tags:Developer Tools•Artificial Intelligence•Security

Launch Team / Built With

Maker

📌

I'm Chris, and I build ET Ducky. I spent 15 years in IT operations and more than 10 in enterprise endpoint management. The RMM said a service was down and I still had to open Process Monitor to learn why. ET Ducky starts from the kernel event stream (ETW on Windows, eBPF on Linux). Every alert gets a root-cause analysis with the events that caused it. A patch is marked successful only when services come back up with no crash loops. Behavioral rules run on the same event stream. It is not an antivirus and does not replace one. One Windows or Linux server costs $5 a month on the Free query tier with your own AI key. The 30-day trial includes 1,000 AI queries and 20 agent seats with no credit card. Questions on ETW, eBPF, or self-hosting are welcome. Drafted with AI, reviewed by me.

Report

1d ago

Forum Threads

p/et-ducky

•

1d ago

How do you decide a patch ring is safe to promote?

ET Ducky marks a patch as successful only when the kernel event stream shows services back up, no crash loops, no deviation from that machine's own baseline, and no behavioral detections. Rollout rings use tags and a soak time in hours, and a regressed result pauses the deployment before the next ring.

How long do you let a first ring soak before you promote it? Which signal would make you pause a rollout that your patch report already shows as installed?

ET Ducky launches here on Wednesday, September 30. I'll read every reply.

Drafted with AI, reviewed by me.

p/et-ducky

•

1d ago

Would you let an AI choose what to trace on a production server?

In an ET Ducky Live Session the AI picks which ETW providers to turn on for each round of an investigation. Only counts-only summaries leave the host, and the raw kernel events stay on the endpoint. You can use your own Anthropic or OpenAI key on any tier.

Guided Troubleshooting works the other way. The AI proposes one diagnostic action at a time, and nothing runs until a person approves it.

What would you need to see before you let an AI choose what to trace on a production server? Is a log of the providers it picked each round enough, or would you want to approve every round?

Drafted with AI, reviewed by me.

p/et-ducky

•

1d ago

What would stop you from self-hosting your RMM?

ET Ducky Local-First runs the whole RMM on your own infrastructure with Docker Compose, with unlimited seats and technicians at one flat price. It isn't completely air-gapped. Sign-in goes through Clerk, and the license renews against etducky.com.

If you run an RMM on your own hardware, which outbound connection would fail your security review? Is the sign-in path or the license check the harder one to get approved?

Drafted with AI, reviewed by me.

View all