# LinuxGuard Documentation

## LinuxGuard Docs

- [Introduction](https://docs.linuxguard.io/readme.md): Overview of LinuxGuard's Linux security monitoring agent — what it does, who it is for, and how to navigate the documentation set.
- [Get Started](https://docs.linuxguard.io/get-started/get-started.md): Onboarding entry point for operators evaluating LinuxGuard — quick start, prerequisites, and choose-your-deployment guidance.
- [Quick Start](https://docs.linuxguard.io/get-started/get-started/quick-start.md): Install the LinuxGuard agent and verify enrollment in five minutes on a supported Linux host.
- [Install](https://docs.linuxguard.io/install/install.md): Install the LinuxGuard agent on supported Linux distributions — per-distro guides, prerequisites, and container deployment.
- [Prerequisites](https://docs.linuxguard.io/install/install/prerequisites.md): Tenant account, credentials, and system prerequisites required before installing the LinuxGuard agent.
- [Multi-Architecture Support](https://docs.linuxguard.io/install/install/multi-architecture.md): Per-architecture capability matrix for the LinuxGuard agent — ARMv7 Degraded mode, RISC-V best-effort, and the eBPF probe gap operators must plan around.
- [Debian / Ubuntu](https://docs.linuxguard.io/install/install/debian-ubuntu.md): Install the LinuxGuard agent on Debian, Ubuntu, and derivatives via the APT repository at packages.linuxguard.io.
- [RedHat / CentOS](https://docs.linuxguard.io/install/install/redhat-centos.md): Install the LinuxGuard agent on RedHat Enterprise Linux, CentOS, and CentOS Stream via the DNF/YUM repository at packages.linuxguard.io.
- [SUSE / openSUSE](https://docs.linuxguard.io/install/install/suse.md): Install the LinuxGuard agent on SUSE Linux Enterprise Server, openSUSE Leap, and openSUSE Tumbleweed via the zypper repository.
- [Alpine Linux](https://docs.linuxguard.io/install/install/alpine.md): Install the LinuxGuard agent on Alpine Linux via the APK repository — OpenRC service management and musl libc considerations.
- [Container Deployment](https://docs.linuxguard.io/install/install/container.md): Decision guide for deploying the LinuxGuard agent in containers — scenario matrix, anti-patterns, and per-orchestrator spokes for Docker, Podman, docker-compose, and Kubernetes.
- [Distroless image reference](https://docs.linuxguard.io/install/install/container/distroless.md): Reference for the LinuxGuard agent distroless container image — contents, exclusions, security context, host paths, PSS compatibility, RBAC, and image-signing verification.
- [Ephemeral mode](https://docs.linuxguard.io/install/install/container/ephemeral-mode.md): Configure the LinuxGuard agent in ephemeral container mode — TOTP enrol, in-memory cert chain, PID 1 auto-detection, TLS cache restart semantics.
- [Kubernetes DaemonSet](https://docs.linuxguard.io/install/install/container/kubernetes-daemonset.md): Kubernetes DaemonSet deployment of the LinuxGuard agent — copy-pasteable YAML with PSS profile comment, line-by-line securityContext rationale, eBPF prerequisites, and RBAC.
- [Downward API integration](https://docs.linuxguard.io/install/install/container/downward-api.md): Kubernetes Downward API integration for the LinuxGuard agent — LINUXGUARD\_NODE\_NAME and LINUXGUARD\_POD\_UID via fieldRef, workload identity derivation.
- [Enrollment tokens](https://docs.linuxguard.io/install/install/container/enrollment-tokens.md): TOTP enrollment token flow for the LinuxGuard agent in containers — LINUXGUARD\_ENROLL\_TOKEN, valueFrom.secretKeyRef pattern, token-hash tag for renewal tracking.
- [docker-compose](https://docs.linuxguard.io/install/install/container/docker-compose.md): Deploy the LinuxGuard agent with docker-compose — compose.yaml example, capabilities, host paths, restart policy, and PID 1 considerations.
- [Podman](https://docs.linuxguard.io/install/install/container/podman.md): Deploy the LinuxGuard agent under Podman — rootless vs rootful trade-offs, systemd quadlet integration, Docker-equivalent commands.
- [OCI multi-arch manifest](https://docs.linuxguard.io/install/install/oci-multi-arch-manifest.md): OCI multi-arch manifest for the LinuxGuard agent container image — docker manifest inspect output, supported platforms, image digest stability, and per-platform pull syntax.
- [Configure](https://docs.linuxguard.io/configure/configure.md): Enroll the LinuxGuard agent to your tenant and set group, tag, and environment flags so it starts sending telemetry to the console.
- [Log Level and Rotation](https://docs.linuxguard.io/configure/configure/log-level-rotation.md): LinuxGuard agent log rotation defaults, configurable knobs, and runtime log level management via config set + SIGHUP reload.
- [Operate](https://docs.linuxguard.io/operate/operate.md): Day-2 operations for the LinuxGuard agent — service management, log inspection, signal handling, support bundles, and uninstall.
- [Log Management](https://docs.linuxguard.io/operate/operate/log-management.md): LinuxGuard agent log management — precise redaction scope, rate limiting drop summaries, and central log collection patterns for journald, syslog, and structured JSON shipping.
- [Support Bundles](https://docs.linuxguard.io/operate/operate/support-bundles.md): Support bundle collection and upload — pre-share PII warning, per-file redaction status, 180 MB cap, presigned S3 upload flow, and decision tree for when to collect.
- [Uninstallation](https://docs.linuxguard.io/operate/operate/uninstallation.md): Uninstall the LinuxGuard agent from a Linux host — package removal, config cleanup, and de-enrollment from your tenant.
- [Deploy at Scale](https://docs.linuxguard.io/deploy-at-scale/deploy-at-scale.md): Deploy the LinuxGuard agent at scale using configuration-management tools and cloud-init mechanisms across Ansible, Chef, Puppet, AWS, GCP, and Azure.
- [Deploy with Ansible](https://docs.linuxguard.io/deploy-at-scale/deploy-at-scale/ansible.md): Deploy the LinuxGuard agent to a fleet of Linux hosts using an Ansible role with Vault-encrypted credentials and idempotent enrollment.
- [Deploy with Chef](https://docs.linuxguard.io/deploy-at-scale/deploy-at-scale/chef.md): Deploy the LinuxGuard agent at scale using a Chef cookbook with chef-vault credentials and idempotent enroll resource.
- [Deploy with Puppet](https://docs.linuxguard.io/deploy-at-scale/deploy-at-scale/puppet.md): Deploy the LinuxGuard agent at scale using a Puppet module with Hiera eyaml credentials and idempotent enroll exec.
- [Deploy with AWS EC2 User-Data](https://docs.linuxguard.io/deploy-at-scale/deploy-at-scale/aws-userdata.md): Provision the LinuxGuard agent on AWS EC2 instances at launch using user-data scripts and credentials from AWS Secrets Manager.
- [Deploy with GCP Startup Script](https://docs.linuxguard.io/deploy-at-scale/deploy-at-scale/gcp-startup.md): Provision the LinuxGuard agent on Google Compute Engine instances using startup-script metadata, Secret Manager, and an idempotency guard.
- [Deploy with Azure](https://docs.linuxguard.io/deploy-at-scale/deploy-at-scale/azure.md): Provision the LinuxGuard agent on Azure Virtual Machines using cloud-init or Custom Script Extension, with Key Vault credentials via managed identity.
- [Respond](https://docs.linuxguard.io/respond/respond.md): Active response and SecOps integration for LinuxGuard alerts — notification rules, webhooks, syslog, and SIEM forwarding.
- [Notification Rules](https://docs.linuxguard.io/respond/respond/notification-rules.md): Configure notification rules in the LinuxGuard console to route signals to webhook, syslog, and Splunk HEC delivery channels.
- [Webhook Integration](https://docs.linuxguard.io/respond/respond/webhook-integration.md): Deliver LinuxGuard security signals to an HTTPS endpoint using signed webhook requests with retry semantics.
- [Syslog Forwarding](https://docs.linuxguard.io/respond/respond/syslog-forwarding.md): Forward LinuxGuard security signals as syslog messages to a SIEM or log aggregator over TCP, UDP, or TLS transport.
- [Splunk HEC Integration](https://docs.linuxguard.io/respond/respond/splunk-hec-integration.md): Send LinuxGuard security signals to Splunk via the HTTP Event Collector with token authentication and index targeting.
- [Audit & Comply](https://docs.linuxguard.io/audit-and-comply/audit-comply.md): Compliance mapping hub for LinuxGuard — three-tier vocabulary (Satisfies / Supports / Out of scope), framework version pin reference, scope statement template, and per-framework page template.
- [PCI-DSS v4.0.1](https://docs.linuxguard.io/audit-and-comply/audit-comply/pci-dss.md): PCI-DSS v4.0.1 control mapping — LinuxGuard agent and console capabilities aligned to Requirements 2, 6, 7, 8, 10, and 11 with Satisfies / Supports / Out of scope tiers.
- [HIPAA](https://docs.linuxguard.io/audit-and-comply/audit-comply/hipaa.md): HIPAA 45 CFR §164 control mapping — LinuxGuard agent and console capabilities aligned to Security Rule technical safeguards with Satisfies / Supports / Out of scope tiers.
- [SOC 2](https://docs.linuxguard.io/audit-and-comply/audit-comply/soc2.md): SOC 2 TSC 2017 (rev 2022) control mapping — LinuxGuard agent and console capabilities aligned to Common Criteria and supplemental TSC categories with Satisfies / Supports / Out of scope tiers.
- [GDPR](https://docs.linuxguard.io/audit-and-comply/audit-comply/gdpr.md): GDPR Regulation (EU) 2016/679 control mapping — LinuxGuard agent and console capabilities aligned to Article 32 security of processing with IP-as-PII gotcha and Satisfies / Supports / Out of scope tie
- [NIS2](https://docs.linuxguard.io/audit-and-comply/audit-comply/nis2.md): NIS2 Directive (EU) 2022/2555 control mapping — LinuxGuard agent and console capabilities aligned to Article 21 risk management measures with member-state transposition note and Satisfies / Supports /
- [DORA](https://docs.linuxguard.io/audit-and-comply/audit-comply/dora.md): DORA Regulation (EU) 2022/2554 control mapping — LinuxGuard agent and console capabilities aligned to ICT risk management, incident reporting, and digital operational resilience testing with effective
- [EU AI Act](https://docs.linuxguard.io/audit-and-comply/audit-comply/eu-ai-act.md): EU AI Act Regulation (EU) 2024/1689 control mapping — LinuxGuard host-layer telemetry for Art 12 record-keeping and Art 15 cybersecurity of high-risk AI.
- [FedRAMP / StateRAMP](https://docs.linuxguard.io/audit-and-comply/audit-comply/fedramp-stateramp.md): FedRAMP Rev 5 and StateRAMP control mapping — LinuxGuard agent and console capabilities aligned to NIST SP 800-53 Rev 5 control families AC, AU, CM, CP, IA, IR, SC, SI, SR with authorization-boundary
- [HITRUST + FFIEC](https://docs.linuxguard.io/audit-and-comply/audit-comply/hitrust-ffiec.md): HITRUST CSF v11.x and FFIEC CAT 2017 control mapping — LinuxGuard agent and console capabilities aligned to HITRUST access control, audit, incident response domains and FFIEC Domain 3 (Cybersecurity C
- [NIST CSF 2.0](https://docs.linuxguard.io/audit-and-comply/audit-comply/nist-csf.md): NIST Cybersecurity Framework 2.0 control mapping — LinuxGuard agent and console capabilities aligned to PROTECT, DETECT, and RESPOND functions with Satisfies / Supports / Out of scope tiers.
- [ISO/IEC 27001:2022](https://docs.linuxguard.io/audit-and-comply/audit-comply/iso-27001.md): ISO/IEC 27001:2022 control mapping — LinuxGuard agent and console capabilities aligned to Annex A Technological controls (A.8.x) with :2013 transition note and Satisfies / Supports / Out of scope tier
- [CIS Controls v8.1](https://docs.linuxguard.io/audit-and-comply/audit-comply/cis-controls.md): CIS Controls v8.1 control mapping — LinuxGuard agent and console capabilities aligned to the 18 control families with explicit separation from CIS Benchmarks and Satisfies / Supports / Out of scope ti
- [CIS Benchmarks (Linux)](https://docs.linuxguard.io/audit-and-comply/audit-comply/cis-benchmarks.md): CIS Benchmarks Linux control mapping — LinuxGuard agent and console capabilities aligned to per-distro hardening configurations with explicit separation from CIS Controls and Satisfies / Supports / Ou
- [Reference](https://docs.linuxguard.io/reference/reference.md): Cross-cutting reference lookups for LinuxGuard — agent commands, supported distributions, and the v4.0 glossary.
- [Agent Commands](https://docs.linuxguard.io/reference/reference/agent-commands.md): Reference for the linuxguard-agent command-line interface — start, stop, status, show-config, enroll, and unenroll commands.
- [CLI Reference](https://docs.linuxguard.io/reference/reference/cli.md): Per-command reference for the linuxguard-agent CLI — start, config, probe, and additional commands shipping in subsequent phases.
- [start](https://docs.linuxguard.io/reference/reference/cli/start.md): Reference for linuxguard-agent start — typical service mode and ephemeral mode flags, environment variables, signals, and exit codes.
- [config](https://docs.linuxguard.io/reference/reference/cli/config.md): Reference for linuxguard-agent config — set, get, unset, and list-keys subcommands for runtime configuration without restarting the agent.
- [probe](https://docs.linuxguard.io/reference/reference/cli/probe.md): Reference for linuxguard-agent probe — host capability check covering kernel, BPF, fanotify, netlink, audit, and Linux capabilities.
- [support-bundle](https://docs.linuxguard.io/reference/reference/cli/support-bundle.md): Reference for linuxguard-agent support-bundle — collect a redacted diagnostic archive locally or upload an existing bundle via a presigned S3 URL.
- [enroll](https://docs.linuxguard.io/reference/reference/cli/enroll.md): Reference for linuxguard-agent enroll — bind a host to a tenant using a long-lived API key, with environment / tag assignment and mTLS certificate provisioning.
- [unenroll](https://docs.linuxguard.io/reference/reference/cli/unenroll.md): Reference for linuxguard-agent unenroll — remove the host from its tenant binding so the agent can be enrolled into a different tenant.
- [show-config](https://docs.linuxguard.io/reference/reference/cli/show-config.md): Reference for linuxguard-agent show-config — print the entire current configuration as indented JSON for inspection or debugging.
- [status](https://docs.linuxguard.io/reference/reference/cli/status.md): Reference for linuxguard-agent status — check whether the agent process is running, by inspecting the PID file and verifying the process is alive.
- [version](https://docs.linuxguard.io/reference/reference/cli/version.md): Reference for linuxguard-agent --version and the build-time metadata (version string, git commit, build timestamp) the agent reports.
- [signals](https://docs.linuxguard.io/reference/reference/cli/signals.md): Signal-handling reference for the linuxguard-agent start process — SIGHUP (log-level reload + log rotation), SIGTERM (143), SIGINT (130), and the re-raise convention.
- [env-variables](https://docs.linuxguard.io/reference/reference/cli/env-variables.md): Environment-variable reference for linuxguard-agent — LINUXGUARD\_ENROLL\_TOKEN, LINUXGUARD\_NODE\_NAME, LINUXGUARD\_POD\_UID, and related variables used by the start command.
- [exit-codes](https://docs.linuxguard.io/reference/reference/cli/exit-codes.md): Exit-code reference for linuxguard-agent — universal codes (0/1/2), signal-induced 128+N codes (130 SIGINT, 143 SIGTERM), and per-command divergences.
- [Supported Distributions](https://docs.linuxguard.io/reference/reference/supported-distributions.md): Per-architecture capability matrix and per-distribution support matrix for the LinuxGuard agent — Debian, RedHat, SUSE, Alpine across amd64, arm64, armv7, and riscv64.
- [Glossary](https://docs.linuxguard.io/reference/reference/glossary.md): Glossary of LinuxGuard terminology — agent, console, eBPF, enrollment, modules, compliance frameworks, and related security concepts.
- [Concepts](https://docs.linuxguard.io/concepts/concepts.md): Conceptual scaffolding for LinuxGuard — security architecture, active response, alerting, and the console pillars.
- [Security Architecture](https://docs.linuxguard.io/concepts/concepts/security-architecture.md): LinuxGuard's zero-trust, least-privilege security architecture — privilege model, eBPF monitoring, and runtime protections.
- [Active Response](https://docs.linuxguard.io/concepts/concepts/active-response.md): How LinuxGuard's active-response model executes automated containment actions with triple opt-in safety and audited rollback.
- [Alerting & SIEM Integration](https://docs.linuxguard.io/concepts/concepts/alerting.md): How LinuxGuard routes security signals to webhook, syslog, and Splunk HEC delivery channels via notification rules.
- [Console](https://docs.linuxguard.io/concepts/concepts/console.md): Overview of the LinuxGuard console — the v3.0 five pillars plus v4.0 expanded pillars (Baselines, Efficiency, Audit, Integrations, Posture, Notifications).
- [Dashboard](https://docs.linuxguard.io/concepts/concepts/console/dashboard.md): The LinuxGuard console Dashboard — identity risk score, fleet posture, top identity risks, and findings feed.
- [Identity Intelligence](https://docs.linuxguard.io/concepts/concepts/console/identity-intelligence.md): Identity Intelligence pillar in the LinuxGuard console — cross-server identity profiles, risk scoring, SSH keys, and access patterns.
- [Zero Trust Enforcement](https://docs.linuxguard.io/concepts/concepts/console/zero-trust-enforcement.md): Zero Trust Enforcement pillar in the LinuxGuard console — signals with MITRE mapping, config drift, SUDO policy, and findings.
- [Compliance & Audit](https://docs.linuxguard.io/concepts/concepts/console/compliance-audit.md): Compliance & Audit pillar in the LinuxGuard console — framework scores, history, suppressions, and audit log export.
- [Infrastructure](https://docs.linuxguard.io/concepts/concepts/console/infrastructure.md): Infrastructure pillar in the LinuxGuard console — fleet inventory, efficiency and rightsizing analysis, and baseline configuration.
- [What Changed](https://docs.linuxguard.io/concepts/concepts/console/whats-changed.md): What Changed in the LinuxGuard console — mapping from the old flat section list to the 5-pillar model.
- [Baselines](https://docs.linuxguard.io/concepts/concepts/console/baselines.md): Baselines pillar in the LinuxGuard console — known-good snapshots of accounts, groups, SSH, and SUDO configuration with drift detection.
- [Efficiency](https://docs.linuxguard.io/concepts/concepts/console/efficiency.md): Efficiency pillar in the LinuxGuard console — rightsizing, storage, network IO, JVM, waste assessment, labor savings, and reports.
- [Audit](https://docs.linuxguard.io/concepts/concepts/console/audit.md): Audit pillar in the LinuxGuard console — authorizations audit and SUDO execution audit for privileged-action reconciliation.
- [Compliance Expansion](https://docs.linuxguard.io/concepts/concepts/console/compliance-expansion.md): Compliance Expansion pillar — frameworks browser, evidence collection, compliance history, reports, suppressions, and evidence location reference.
- [Integrations](https://docs.linuxguard.io/concepts/concepts/console/integrations.md): Integrations pillar — JIRA, Microsoft Teams, Slack, Syslog, SIEM, generic webhooks, and delivery tracking from the LinuxGuard console.
- [Zero Trust Expansion](https://docs.linuxguard.io/concepts/concepts/console/zero-trust-expansion.md): Zero Trust Expansion pillar — policies, findings, playbooks, active responses history, SUDO policies and executions, SELinux, and policy violations.
- [Posture](https://docs.linuxguard.io/concepts/concepts/console/posture.md): Posture pillar — Compliance Posture, Configuration Posture, Health Posture and the rationale for consolidation under one navigation label.
- [Notifications](https://docs.linuxguard.io/concepts/concepts/console/notifications.md): Notifications pillar — notification rules, suppressions, and rule edit/new flows in the LinuxGuard console.
- [Troubleshooting](https://docs.linuxguard.io/troubleshooting.md): Diagnose and resolve common LinuxGuard agent issues — log inspection, enrollment errors, runtime problems, and integration failures.
- [Support](https://docs.linuxguard.io/support.md): Contact information and help resources for LinuxGuard — 24/7 support channels, what to include in requests, and self-service routes.
- [Changelog](https://docs.linuxguard.io/changelog.md): Release notes and documentation change history for LinuxGuard, organized in Keep a Changelog format with semantic versioning.