How often do checks run?

Each rule has its own cycle, typically hourly. For troubleshooting, admins can also run an ad-hoc command on a host from its overview.

What does the agent need on the host?

Permission to run the rule's read commands. Each rule documents the minimal privilege it needs; most need none.

Can I write my own rules?

Yes. Rules are JSON, edited in the console, with per-OS commands and expectations. The library is open source.

How it works

Collect. Judge. Fix. Prove.

LEA Platform separates collecting from deciding. Agents gather raw system state; your LEA server decides what passes, what gets fixed and what goes into the evidence.

Start a free POC See the rule library

Agents

One small agent per host.

A single Go binary for Linux, Windows and macOS, with a watchdog that keeps it running and updates it.
It runs the commands a rule asks for, such as reading a config file or a kernel setting, and sends back the raw output.
No parsing on the host, and no inbound port: the agent connects out to your server.

LEA Platform host list with pass/fail status, operating system and enrollment state — Host list with status, operating system and enrollment state.

Rule engine

The verdict is made centrally.

Each rule says which command to run per operating system and what the output must (or must not) contain.
The LEA server checks the raw output against those expectations and records pass or fail.
Change a rule once; every host is judged by the new rule on its next cycle.

LEA rule editor with validation commands per operating system and expected output patterns — Rule editor with validation commands per operating system.

Remediation

Fix drift where you allow it.

Add a remedy to a rule, for example a kernel setting or a service state.
When the check fails, LEA runs the remedy and checks again; both results are kept.
Rules without a remedy never change anything.
Already standardised on Ansible or AWX? Run the same rules from your playbooks.

Evidence

Evidence that explains itself.

Scheduled evidence snapshots per framework, every record signed with HMAC-SHA256.
Five PDF reports written for the IT Manager, CISO, GRC Technical, GRC Legal and the External Auditor.
Webhooks to Slack or any endpoint, and export to Elasticsearch.

Target the right rules at the right hosts.

Static, dynamic and nested groups for hosts and rules.
Dynamic groups match on host data, such as operating system, distribution or tags.
Rules carry per-OS commands, so one rule covers a mixed fleet.

Production group expanded with its rules, hosts and a nested Payments (PCI) group — Production group with its rules, hosts and a nested group.

AI assistant

Ask your compliance data a question.

"Which production hosts fail SSH rules this week?" becomes a read-only query, a table and a chart.
Runs on a local model by default; external model providers are optional.
An MCP server lets your own AI tools read hosts, rules and results.

Ask
Query
Chart

Runs on your infrastructure.

Docker Compose
The quickest start: one host, optional profiles for SSO and the AI assistant.
Kubernetes
Manifests for the core services.
Any container host
Any Linux server or cloud VM that runs containers: on-premises, AWS, Google Cloud or Azure.

Sign in with local accounts or single sign-on through Keycloak or Microsoft Entra ID (OIDC). Admin and read-only roles. Encrypted database backups to local disk, SSH or S3-compatible storage. Offline license file; no call-home.

FAQ

Try it on your own servers.

30 days, up to 25 endpoints, every feature. We help you install it and agree on success criteria first.

Start a free POC