AI Defence / Linux host assessment
See the host behind the finding.
The Linux development component collects local host and configuration evidence, runs deterministic checks and produces structured findings. Its purpose is to help reviewers understand an observed condition in the context of the actual workload.
Ten collector families, local scope
The dispatcher includes system, users, network, services, storage, security, applications, cloud, containers and processes. A host report brings those areas together for review. Each collector remains bounded by its implementation and available permissions.
These categories describe code organisation and local evidence collection. They do not mean complete discovery of every system, a whole cloud tenancy or every device on the network. Production operating-system support must be confirmed for the candidate build.
Assessment and change observations
An initial assessment can run at startup, with later assessments and monitoring on configured intervals. Selected process observations, integrity hashes, authentication logs and configuration digests add context about changes.
The local vulnerability implementation is a limited rules-and-advisory set. It is not a continuously updated complete CVE database. A version-based finding may need distribution and backport analysis before it is treated as a confirmed exposure.
Explain the result in practical terms
Structured findings include technical explanation, risk, business impact, recommended action and rollback-description fields. Those fields help an operator understand both the condition and the questions to ask before changing the host.
An agent cannot assess inputs it cannot read. A report should be evaluated alongside configured collection, permissions, errors and scope. Code-defined explanations should not be mistaken for evidence of a deployed AI model.
Keep runtime work within its actual capability
Registered remediation structures exist in the development source, and the example disables remediation. Any permitted hardening action needs a specific supported path and verification of effect, failure and recovery in the pilot.
The related Remedy runtime agent and host dashboard are separate foundations. Their registration, heartbeat and operational actions do not establish that the Linux security component has been integrated into a released AI Defence console.
Linux within the wider Core architecture
Linux servers need host posture, workload and configuration evidence, identity, appropriate remediation and validation. They generally do not need the graphical external-content interaction layer intended for employee workstations.
The wider Core model extends these concerns across host and network authority. It preserves the distinction between the inspected local collectors and planned integrated enforcement, certification and recovery. A Linux component’s existence does not establish complete fleet protection or production support for every distribution.
Questions answered
Talk directly to Altari
Bring the environment.
Start with the right questions.
Discuss a demonstration, current capabilities and a bounded evaluation with Altari Systems.