THE FIELD GUIDE / SECURITY & RESPONSE
File integrity & startup baselines
Compare native package state, authenticated artifacts and custom scope.
Inspect packages
Select installed packages for native dpkg or RPM verification, then review discrepancy flags, missing paths and coverage gaps. Native local-database verification is distinct from independent authenticated artifact comparison.
Compare trusted artifacts
Authenticate Debian and RPM package artifacts through repository trust, compare exact installed-version file evidence and preserve the comparison receipts. Custom integrity scopes and administrator-reviewed baselines extend the checks to site-specific files.
Hardware-backed attestation
On supported hardware, attestation adds platform-backed measurements to package and custom-baseline evidence. Enrollment, platform prerequisites and policy determine the coverage; review that evidence separately from ordinary collector telemetry.
Review startup changes
Discover system and per-user jobs, units and supported boot/login mechanisms without executing their contents. Compare effective configuration and authenticated package defaults with reviewed baselines, retain changes and inspect explained assessments. Explore startup and scheduled-task awareness.
Open the application reference for capability scope and technical details.
Open Open SECURITY_IMPLEMENTATION.md on GitHub ↗