Skip to content
LEA Platformby GSR

Rule library

Hardening rules you can read.

Every LEA Platform rule is plain JSON: what to run on each operating system, what the output must show, and how to fix it. The library is open source.

Browse on GitHubStart a free POC

Four parts. No magic.

Validation:
the read-only command per OS and distribution, e.g. cat /proc/sys/kernel/randomize_va_space.
Expect:
what the output must or must not match, judged on the server.
Remedy (optional):
the command that brings the setting back, run only when the check fails.
Tags:
severity, category, the minimal privilege needed and every control it supports.
{
  "name": "Kernel ASLR Fully Enabled",
  "category": "system_hardening",
  "cycle": 3600,
  "cmd": {
    "validation": [{ "command": "cat /proc/sys/kernel/randomize_va_space", "system": ["Linux"] }],
    "expect": [{ "system": ["Linux"], "re": { "stdout": "^2$" } }],
    "remedy": [{ "command": "sysctl -w kernel.randomize_va_space=2 >/dev/null && cat /proc/sys/kernel/randomize_va_space", "system": ["Linux"] }]
  },
  "tags": ["risk:high", "std:CIS_Controls_v8:10.5", "std:NIST_800-53:SI-16", "std:ISO27001:A.8.9", "std:SOC2:CC6.8", "std:CMMC:CM.L2-3.4.2", "std:NIS2:Art21.2(e)"]
}

Written to be trusted.

  • Raw output

    Commands read files and kernel values directly; no filtering on the host.

  • Least privilege

    Each rule states the minimal privilege it needs. Most need none.

  • Per-OS

    One rule, separate commands and expectations per operating system and distribution.

  • Safe remedies

    Remedies are optional, idempotent and only run when the check fails.

Find the crypto that won't age well.

23 checks for legacy SSH algorithms, post-quantum key exchange support in OpenSSH and OpenSSL, system crypto policies, TLS versions, Windows FIPS mode and .NET strong crypto, tagged to the NIST post-quantum standards (FIPS 203/204/205).

About post-quantum readiness

Your policy, your rules.

Write rules in the console's rule editor, test them on one group, then roll them out. Tag them with your own controls and they appear in your evidence.

    LEA rule editor

    FAQ

    LEA Platform produces evidence; certification is granted only by an accredited auditor.

    CIS and CIS Controls are trademarks of the Center for Internet Security.

    Try it on your own servers.

    30 days, up to 25 endpoints, every feature. We help you install it and agree on success criteria first.

    Start a free POC