Compliance, Security & Auditability
Operational control with built-in governance. OpenSCAP compliance scanning (CIS, STIG and more), Lynis hardening audits, an audit log of admin and agent actions, and file integrity monitoring of critical system files.
Compliance Scanning
- OpenSCAP with SCAP Security Guide content: CIS Level 1/2, STIG, ANSSI, PCI-DSS, HIPAA, OSPP and Essential Eight profiles (as shipped for each distro)
- Best profile auto-selected per host (CIS Level 1 Server first), or steered to a preferred framework
- Ubuntu, Debian, Fedora, RHEL/CentOS, AlmaLinux, Rocky, Oracle Linux, Amazon Linux 2023, openSUSE/SLE
- Rule severity: High, Medium, Low
- Per-rule fix scripts plus a downloadable OpenSCAP-generated Ansible remediation playbook per host
- Scheduled scans (daily/weekly, chosen days, time window) plus on-demand scans
- Failed controls tracked with first/last seen and waivers (per finding, per host or fleet-wide, with expiry)
- Lynis hardening audit with a hardening index per host
Compliance Posture Dashboard
- Pass-rate compliance score per host and fleet average
- Per-framework breakdown via framework selector
- Failed controls, hosts affected, scanned vs unscannable hosts
- Per-host HTML compliance report download
Activity & Audit Log
- Admin and agent actions audited with user, IP address and timestamp
- Event categories: Authentication, User management, Configuration, Service ops, File ops, Security, System
- Filtering by event type, user, agent and status, with free-text search
- Statistics: total, authentication, configuration and failed events
- Export to CSV or JSON
File Integrity Monitoring (FIM)
- Continuous checks of critical files: passwd, shadow, group, sudoers, sshd_config, crontab, hosts, ld.so.preload, PAM
- Auto-discovered paths: sudoers.d, every user's authorized_keys, cron directories, profile.d, ld.so.conf.d, systemd units
- SHA-256 baseline of content, mode and ownership
- Change types: created, modified, deleted, permission change, with High/Medium/Low severity
- Views by host and by path with drill-down
Security Monitoring
- Security score (0-100) with A-F grade and category breakdown
- Categories: Network, Authentication, Filesystem, Vulnerabilities, Hardening, Malware
- Failed login attempts, sudo events, root logins, flagged IPs
- Country and ASN per source IP, with new-country and brute-force-then-success flags
- Vulnerability scanning with Trivy (OS & language packages, kernel CVEs), enriched with CVSS, EPSS and CISA KEV
- YARA malware scanning and listening-port audit
Incident Management
- Declare incidents with SEV levels and track status
- Incident timeline entries: updates, actions, communications, investigation notes
- Resolve and write a post-mortem
- Managed alongside alerts in the Alerting hub