Groups

Groups decide which rules run on which hosts in LEA Platform. A group has members (hosts) and assigned rules. Membership can be:

• static: hosts you pick,
• dynamic: all hosts, or hosts matched by a JSONPath expression on their dynamic tags,
• nested: hosts or rules taken from other groups.

Deployment tokens are tied to a group, so newly enrolled hosts land in the right group (see Agent enrollment).

Group editor

• Name, Description, Active
• Clients: pick hosts
• Rules: pick rules; added rules are listed with a remove option

Dynamic settings

JSONPath is evaluated against each host's dynamic tags (the rule outputs stored with Command Info Key). Example, assuming a rule stores its output under the tag hostname:

$.hostname.stdout ? (@ like_regex "^web-")

This matches every host whose hostname tag starts with web-. New hosts that match join the group on their own and get its rules. Test an expression on a few hosts before relying on it.

Nested groups

Click Add Nested Group, choose the source group and the Nesting Type:

• Rules: add all rules of the source group. Example: nest "Kernel Security" to add its rules (dmesg restricted, SELinux enforcing, AppArmor enabled, protected hardlinks/symlinks, ptrace scope, unprivileged BPF disabled, ...).
• Clients: add the hosts of the source group, to build a superset group.

A preview shows what will be added. The Nested Groups list shows each nested group with its type (Rules or Clients), the number of items, and expand/remove controls.

Nesting is resolved each time membership is evaluated, and it follows nested groups recursively. It includes the source group's static members and rules; the source group's dynamic settings (All Clients, JSONPath) are not carried over.

Creating a group

1. Turn on Active, give it a Name and an optional Description.
2. Choose membership: All Clients, pick hosts, a JSONPath expression, or Add Nested Group (Clients).
3. Assign rules directly, or nest rules from another group.
4. Review and save.

Patterns

• Baseline inheritance: a "Security Baseline" rules group nested into "Web Servers" and "Database Servers".
• Framework bundles: "Kernel Security", "Password Policy" and "Identity Management" nested into one larger rules group.
• Environment groups: "Development" and "Staging" host groups nested into "Non-Production".

Good practice

• Name groups for their purpose and scope.
• Use Exclude from All Clients sparingly; it creates gaps on purpose.
• Use nesting to avoid copying the same rules into many groups.
• Review membership and nesting from time to time; the host overview's Groups tab shows every group a host is in.