Hardentra
Select CIS controls, validate them, attach evidence
Hardentra keeps Ubuntu and Windows hardening work in one place: rule catalog, conflict checks, artifact generation, and Windows agent results. It produces downloadable output and verifiable scan records, not vague posture claims.
PermitRootLogin to noufw rules must be applied firstWhat a security team needs: one flow from selection to evidence
Rule selection, validation, artifact generation, and agent status are steps in the same process. Hardentra connects them into one consistent workflow, not a set of marketing promises.
CIS rule catalog
Filter rules by platform, section, CIS level, and automation state. The Ubuntu 24.04 and Windows 11 catalogs are handled as distinct workspaces.
Dependency and conflict checks
Your selected rule set passes through the resolver before any artifact is generated. Missing dependencies, conflicting rules, and parameter warnings stay visible in the same panel.
Auditable artifact generation
Generate Bash, PowerShell, GPO, and Ansible output. Every download records its rule count, format, and SHA-256 metadata.
Windows agent evidence
A Windows service enrolls with a token, then sends heartbeat, inventory, scan run, and rule result records back to the account. The dashboard turns that into an operations view.
Conflict resolver
Automatically detect dependencies and conflicts between rules. The smart resolver blocks incompatible configurations while you are still selecting.
Verifiable hash
Every generated artifact is signed with SHA-256. Prove policy integrity during audits and track change history over time.
Close the gap between policy intent and endpoint evidence
This is not a marketing funnel. It is the day-to-day security workflow: which control was selected, why it warned, which file was generated, and what the agent reported afterwards.
-
Narrow the rule set
Use platform, level, automation, and search filters to remove controls that do not belong in the current job.
-
Catch problems before rollout
The resolver surfaces missing dependencies or rule conflicts before the workflow reaches artifact generation.
-
Export platform-native output
Selected controls are converted into Bash, PowerShell, GPO, or Ansible format.
-
Bring agent results back to the dashboard
The Windows agent reports scan results as pass, fail, manual, error, and not applicable states.
Runs on-premise, your data stays with you
Hardentra runs on your own infrastructure, on a single host with Docker Compose. The rule catalog, generated artifacts, agent records, and scan evidence never reach an outside service.
Designed to run in an isolated network
Every component is local: PostgreSQL, Redis, the API, the web interface, and a TLS-terminating reverse proxy. There is no external service dependency.
- Artifact storage on the local filesystem — no cloud object store required
- Email and notification channels can be switched off, so no traffic leaves the network
- Windows agents connect over TLS using your own internal certificate authority
- Backups stay in your hands with pg_dump and volume archives