TotalHealInfraGuard

How it works

1. ScanThe server agent reads the host — files, kernel settings, services — every 6 hours and on demand; nothing is changed.
2. ScoreEach check passes or fails with evidence; a severity-weighted score per server and for the fleet.
3. AlertA check that newly fails at critical or high raises an alert in the incident queue.
4. ApproveSomeone requests a fix with a reason; a different person approves it.
5. Fix and verifyThe agent backs up, applies, re-reads the host and rolls back any fix that did not take effect.

Reference architecture

Key capabilities

• 79 checks with evidenceSSH (root and password login, attempts, ciphers, MACs, key exchange, host keys), kernel and network settings, accounts and PAM, file permissions, services, logging and audit, updates, firewall, time sync, SELinux / AppArmor, Secure Boot and Docker — each result with the exact value found.
• Why it matters, how to fixEvery check explains the risk in one sentence and names its fix or the guidance to follow.
• Score per server and for the fleetA severity-weighted score from 0 to 100 (critical 10, high 6, medium 3, low 1), score history, and the checks failing on most servers.
• Drift alertsA check that newly fails at critical or high raises an alert (MITRE ATT&CK T1562.001) in the same incident queue as every other alert.
• Fixes with four-eyes approvalRequest a fix with a reason; a second person approves — never the requester, never an AI; the agent applies it as a signed command.
• Backup, verify, roll backEvery file a fix touches is backed up first; the host is re-read to check the fix took effect, and a fix that did not is rolled back automatically. Any applied fix can be rolled back later, byte for byte.
• Safe where it mattersSSH changes are validated with sshd -t before reload; firewall and partition changes are guidance only, never automatic; remediation runs only where the host owner allowed it.
• Accepted risksAn exception for one server or all servers needs a reason, an expiry of up to a year and a second person; it leaves the score while it lasts.
• Evidence by controlResults grouped by ISO 27001:2022 Annex A control and the CERT-In directions (log retention, clock synchronisation) for auditors.
• On the host toototalheal-server-agent infraguard scan | fix | rollback runs the same benchmark on a server without the cloud.

In the console

Deployment options

System requirements

Technical specifications