Lawliet documentation

Lawliet is a self-hosted compliance and security operations platform. It runs on one Linux server you control, watches your hosts through small pull-only agents, and keeps every result, and the evidence behind it, on that server.

Getting startedRequirements, installation, activation and your first hosts. Platform modulesWhat each module does, from compliance to forensics. Security modelAgents, signed commands, roles, four-eyes approval and two-factor. Licensing and suitesSuites, build your own, offline activation, renewals and expiry. AgentsSupported systems, what agents collect and how they are enrolled. Operations and updatesBackups, updates, retention and forwarding to your SIEM. Release notesWhat changed in every version, newest first.

How it is delivered

You receive a signed bundle built for your organisation. It installs with one command, carries no licence, and runs without internet access. When the installer finishes it prints this installation's fingerprint; send it to us and we return a licence that works on that installation only.

Install the bundle on a Linux server with Docker.
Sign in, set your own password and enrol two-factor.
Activate with the licence issued for your fingerprint.
Enrol your hosts and schedule the first scans.

Operators installing a bundle can follow the printable installation guide, which walks through every step with checkboxes and troubleshooting.

Getting help

Write to [email protected]. On the server, ./lawliet doctor collects a diagnostics file for us; it holds no passwords and no data. Security issues go to [email protected].