Fleet dashboard

Baseline creation

A baseline is a point-in-time snapshot of a host's security-relevant configuration: listening ports, local users and group memberships, sudo rules, enabled systemd units, SSH daemon policy, firewall rules, installed packages, and kernel parameters. Without an explicit baseline, drift is undetectable — you cannot tell whether a new port or user is authorized or a sign of compromise. Baselines are also compliance evidence: proof that a system was in an acceptable state at a specific time.

Drift detection

At each scan, BLACKGLASS re-collects the same surface areas and diffs against the active baseline. Every changed, added, or removed item surfaces as a finding. Configuration drift is a well-documented attack vector — attackers abuse CI pipelines, provisioning scripts, and emergency access to make changes that are never reviewed or reverted. BLACKGLASS makes that drift visible and attributable.

Risk classification

Raw findings are classified into categories that map to standard security risk taxonomy: network exposure, identity drift, persistence, policy mismatch, and package / supply-chain changes. Classification tells a responder whether a finding is a potential lateral-movement vector, a compliance gap, or a sign of attacker activity — so teams can triage rather than guess.

Evidence and reporting

• Host baseline report — structured record of what the host looked like at baseline time, suitable for a change record or audit questionnaire
• Drift report — timestamped diff between baseline and current state, with risk classification and recommended response
• Fleet posture summary — across all enrolled hosts: unacknowledged drift by category and severity, with trending
• Evidence bundles (Pro / Enterprise) — exportable packages containing baseline, findings, acknowledgements, and operator notes for SOC 2, post-incident review, or CAB submission
• Audit timeline — chronological view of what changed on each host across all scans