Compliance evidence & reports

LEA Platform keeps signed, machine-readable evidence of your hosts' compliance state, so you don't have to collect screenshots and spreadsheets before an audit.

LEA Platform produces evidence; certification is granted only by an accredited auditor.

How it works

Evidence runs on its own schedule, separate from the checks:

On each snapshot, LEA reads the latest verified results for all active hosts and writes one evidence record per host and control in each enabled framework. Each record is signed with HMAC-SHA256. Evidence records cannot be changed after they are written.

check results (append-only)  ──►  evidence records (signed, write-once)
                                         │
                           ┌─────────────┼─────────────┐
                           ▼             ▼             ▼
                       Dashboard     PDF export    JSON export

Configuration

Settings → Compliance, per framework:

Frameworks

A rule is included when one of its tags starts with the framework prefix. A rule can belong to several frameworks.

Signing key

The deployment uses one HMAC-SHA256 signing key; its fingerprint is shown on the settings page. You can rotate it (generate a new one or set your own). Older evidence keeps its original signature and stays verifiable.

Compliance Evidence page

One card per enabled framework:

• overall pass rate,
• last and next snapshot time,
• Drift (PASS → FAIL): controls that regressed since the previous snapshot,
• pass/fail by host group.

Buttons on each card:

• Inspect: open the evidence explorer for the latest snapshot.
• Snapshot: take a snapshot now.
• JSON / PDF: download the report for the latest snapshot.

Evidence explorer

• Filter: All, PASS only, FAIL only (with counts).
• Group By Control or By Host, most failures first.
• Expand a row to see each result: the observed value (raw output captured from the host, e.g. PermitRootLogin yes), timestamp, agent version and record hash.

Exports

JSON report (shape):

{
  "framework": "CIS",
  "snapshot_id": "7a6913da-...",
  "signing_key_fingerprint": "6b6a298d8a441a2a",
  "generated_at": "2026-05-28T10:00:00Z",
  "snapshot_metadata": { "host_count": 8, "pass_count": 142, "fail_count": 23 },
  "evidence": [
    {
      "host": "web-01",
      "control_id": "CIS-5.2.8",
      "result": "PASS",
      "value": "Protocol 2",
      "ts": "2026-05-27T22:27:31Z",
      "agent_version": "2.0.2",
      "signature": "f03c98dbf144..."
    }
  ]
}

PDF report: A4 landscape; header with snapshot ID, signing key fingerprint, host count, PASS/FAIL totals and generation time; one row per result with control, host, result, timestamp, observed value or evidence reference, record hash and agent version.

Verifying a record

Each record's signature is HMAC-SHA256 over the record's fields (sorted, excluding the signature). The PDF shows the first 12 characters. An auditor with the key can recompute it for any record.

Reports page

The Reports page has six tabs: GRC, Clients, Rules, Execution, Drift (PASS → FAIL) and Audit.

From the GRC tab you can produce five stakeholder PDF reports from the same snapshot, or all five as one ZIP:

For day-to-day status, use the Compliance and Execution pages.