THE FIELD GUIDE / SECURITY & RESPONSE
Read-only security posture & compliance
Review versioned configuration rules and their measured evidence without changing the target.
Inspect applicable controls
Review SSH, sudo, accounts, authorized keys, firewall, audit and SELinux or AppArmor checks where supported. Each result records the rule version, expected configuration, measured state and relevant guidance.
Treat unknown as a distinct outcome
Pass, fail, not applicable and unknown carry different meanings. Collection errors, stale records and unavailable permissions remain visible. The collector bounds evidence and redacts secrets.
Review narrowly scoped exceptions
Record an owner, rationale, exact scope and expiry for each exception. Changed rules or evidence trigger review, and expired exceptions return to attention. Any corrective action follows its own approval workflow.
Open the application reference for capability scope and technical details.
Open View scope in issue #335 ↗