On this page

• Overview
• What is checked
• How it works
• Public vs. private context
• Automated remediation
• PDF reports & scheduling

Overview

The Security Audit is a deterministic, skill-free hardening scan that runs directly from the agent. No LLM calls, no external APIs — just read-only check commands executed inside a Landlock sandbox, with every finding evaluated against a strict rule set defined on the portal.

Unlike agentless scanners that ship a single profile for every server, ManageLM knows the context of each agent. A public, internet-facing box is held to a much stricter standard than an internal database server. Severity changes automatically, so your compliance score reflects actual risk — not theoretical checklist items.

What gets checked

Each audit runs 18 checks across five categories. Findings are categorized, explained, and paired with a concrete remediation you can click to apply.

How it works

1. Trigger
   From the Infrastructure page, the Compliance dashboard, or via an MCP call from Claude. No configuration needed — the agent is ready as soon as it is online.

2. Collect
   The portal sends deterministic check commands (defined in reports/security.json) over the existing WebSocket. The agent executes them inside a Landlock read-only sandbox — it cannot modify disk during an audit.

3. Evaluate
   The portal runs the raw output through 23 compliance rules. Each rule produces a pass/fail with severity, framework tags (CIS, PCI-DSS, SOC 2), explanation, and remediation. A weighted score (0–100) is computed.

4. Report
   Findings appear in the audit modal and the Compliance dashboard. In-app notifications fire on completion, and drift alerts fire when a previously-passing rule starts failing.

Public vs. private context

ManageLM automatically classifies each agent as public (internet-reachable) or private (internal network) and adjusts severity accordingly. The same finding lands differently based on exposure:

This context-aware scoring means your compliance dashboard shows real risk, not inflated noise. A lab VM with a relaxed configuration won't drag down the score of your production fleet.

One-click automated remediation

Select one or more findings, click Remediate, and the agent applies the recommended fixes intelligently — using its assigned Security & Hardening skill. Before every change, the agent:

• Backs up the original configuration file with a timestamped suffix.
• Applies the minimal change required by the remediation text.
• Validates the new config (e.g. sshd -t) before restarting the affected service.
• Rolls back automatically if validation fails.

PDF reports & scheduling

One Security button at the top of the Infrastructure page downloads a fleet-wide PDF report: summary bar with issue counts by severity, detailed findings with explanations and remediation, and a list of passed checks per server.

The Schedules popover turns any report into a recurring email — daily, weekly, or monthly — delivered to admin users who have report_ready notifications enabled. Changing the email schedule automatically syncs the scan schedule across all agents, so reports always reflect fresh data.