Configuration compliance for workstations and servers

Security settings on Windows and Linux workstations and servers: password and lockout policy, audit policy, session lock, cryptography settings, and malware protection, host firewall, and disk encryption status. Checks run through the endpoint agent or without an agent over SSH or WinRM.

STIG-oriented baselines. STIGs are the Security Technical Implementation Guides published by the Defense Information Systems Agency (DISA). Checks come in versioned probe packs that an administrator uploads and activates, and each pack is pinned by its hash. The packs cover selected STIG settings, not every STIG rule for every operating system.

Yes, for known settings. Fix-It pushes a repair to the system with operator confirmation, can run as a dry run first, and logs every attempt. Repairable settings include Windows password policy, audit policy, account lockout, session lock, and the FIPS cryptography setting, and Linux password aging, audit daemon, and session lock, with or without an agent.

Some findings need your IT team: for example, the host firewall and disk encryption are detected and flagged for IT, not changed remotely. Each finding says who should act: the product can repair it, it needs IT, or it is observe only.

A finding is closed only when a later rescan no longer finds it. Applying a fix is not proof by itself.

The enclave's workstations and servers are set up to STIG-oriented baselines, and the kit checks them against those baselines continuously. Windows workstations can also get an install lockdown pack that blocks unapproved software.

Yes. Workstation checks can be required before a person connects, so a system that fails its checks is not allowed in until it is fixed.