How It Fits Together
From asset discovery through audit execution, controlled remediation with rollback, and tamper-evident evidence packaging, the five products in this suite cover the full security operations and compliance lifecycle. Each tool is purpose-built and self-hostable. Together they form a complete platform that deploys in your environment without external cloud dependencies.
Toolkit Structure
The Audit Admin Toolkit is the core platform, with distinct sub-tools and agent models that support different deployment patterns across five products.
| Layer | What it includes | Why it matters |
|---|---|---|
| Core platform | Web application, central workflow engine, and REST API (390+ endpoints) | Single control plane for findings, evidence, scheduling, and reporting |
| Audit script libraries | Linux scripts, Windows PowerShell scripts, and hypervisor audit scripts | Covers server, endpoint, and virtualisation audit scenarios in one platform |
| Agent execution layer | Standalone Agent, Fleet Agent, Hypervisor agent, plus Fleet Agent coordinator service | Supports single-host, fleet-scale, and hypervisor-native collection modes |
| Extension and companion tools | Linux Security Lite, CMDB API Data Collection Tool, Asset Command Center, Secure Exposure Centre | Adds deeper Linux controls, ingestion/normalization, and asset governance context |
| Remediation and evidence | SuperAdmin-gated direct host remediation over SSH and WinRM. Secondary auth token required. Atomic rollback by execution ID. SHA-256 signed evidence packages with MANIFEST.json for auditor delivery. | Controlled change execution with full audit trail, rollback safety, and tamper-evident compliance evidence output. |
Tool Map
Each product is purpose-built, but designed to interoperate in one governance and operations model.
Ingestion and normalization layer
Audit operations and evidence layer
Linux control depth extension
Asset intelligence and enrichment layer
Network switch exposure operations layer
Use-Case Matrix
Primary indicates the main owning tool. Supporting indicates where companion tooling adds value.
| Use Case | Primary Tool | Supporting Tool(s) | Typical Output |
|---|---|---|---|
| Infrastructure data intake and connector polling | CMDB API Data Collection Tool | Asset Command Center | Normalized inventory + vulnerability-linked records |
| Audit finding lifecycle and remediation tracking | Audit Admin Toolkit | Linux Security Lite | Findings queue, evidence reports, closure records |
| Direct host remediation with atomic rollback | Audit Admin Toolkit | SuperAdmin remediation APIs | Execution history, rollback records, change evidence |
| Asset discovery with CVE and KEV correlation | Audit Admin Toolkit (native asset discovery) | CMDB API Data Collection Tool | Normalized asset records with CVE and KEV risk context |
| Linux hardening and compliance control verification | Linux Security Lite | Audit Admin Toolkit | Control-level pass/fail evidence and reports |
| Asset governance and command-center views | Asset Command Center | CMDB API Data Collection Tool | Asset context dashboards and enrichment state |
| Compliance evidence packaging for review | Audit Admin Toolkit | Linux Security Lite, CMDB API Data Collection Tool | Evidence exports for internal/external assurance |
| Switch firmware advisory and network exposure tracking | Secure Exposure Centre | CMDB API Data Collection Tool, Asset Command Center | Switch-centered exposure reports with CVE and advisory context |
Operational Flow
The tools are designed as an operational chain, not isolated silos.
CMDB API and asset discovery gather host, software, and network inventory. CVE and KEV context are applied per asset.
Asset Command Center layers governance context, ownership, and lifecycle visibility. Secure Exposure Centre adds network infrastructure posture.
Audit Admin Toolkit runs audit workflows and Linux Security Lite adds deeper Linux control verification.
SuperAdmin-gated direct host remediation over SSH and WinRM with secondary auth and dry-run preview before every execution.
Post-remediation validation with automatic or manual rollback by execution ID when outcomes are not compliant.
SHA-256 signed evidence packages, SIEM export, trend analysis, and compliance trajectory reporting for continual improvement.
Start Paths
Quick entry points for teams that need an immediate operating path.
Deployment Models
| Mode | Description | Best for |
|---|---|---|
| Single-host (Standalone Agent) | Core platform plus Standalone Agent on one machine. Local dashboard, local findings, and no coordinator required. | Small environments, evaluation, developer workstations |
| Fleet (Fleet Agent + Coordinator) | Fleet Agent deployed to target hosts with a coordinator service for centralized collection and reporting. | Multi-server environments and recurring scheduled audits |
| Hypervisor-native | Hypervisor agent for ESXi, KVM, Nutanix, Proxmox, and Xen with audit scripts run against hypervisor layers directly. | Virtualization estate audit and compliance |
| Air-gapped / offline | Offline MSI installers with no outbound internet requirement and agent deployment without external connectivity. | Financial services, healthcare, government, and defense supply chain |
| CI/CD integration | Linux Security Lite with AUDIT_SKIP_LICENSE_CHECK for pipeline use, stable control IDs, and JSON/CSV outputs with GitHub issue creation. | DevSecOps, developer workstations, and pipeline gates |
Tell us your environment goals and we will map the right starting sequence across the four tools.