Lawliet usage guide

This guide describes Lawliet 1.5.13.s (the current release). Screens, commands and procedures may change in later versions; the usage guide is updated with each release. Check the version your server runs under Settings > Platform or with ./lawliet version, and see the Releases page for what changed.

Step-by-step instructions for the people who install and run Lawliet: server administrators, security officers and analysts. It covers the server and its ./lawliet command, the agents, and every area of the web console, for release 1.5.13.s.

The guide is complete on its own: you should not need any other document to install, operate, update or recover Lawliet. Where a reference document has more background, the chapter links to it.

How to read this guide#

Start here. If you are installing, read 1. Overview and concepts, then follow 2. Installation from top to bottom. Everyone else can go straight to the chapter for their task (see I want to... below).

Each procedure has the same parts:

Part	What it tells you
You need	The access required: root on the server, the console permission, and whether a second administrator must approve (four-eyes)
Numbered steps	Do them in order
What you see	The output or screen that shows the step worked
If it fails	The messages you may get, what they mean and what to do
Risk and Rollback	For anything that changes a server or a monitored host: what can go wrong, and how to undo it

Commands. Everything in a code block is typed exactly as shown, except text in angle brackets, which you replace: <address>, <version>, <file>. Server commands are run in the installation directory (for example /opt/lawliet-1.5.13.s), as root or with sudo.

Console paths. Written as Sidebar entry > Page or tab > Section > Button, using the exact labels on screen, for example Settings > Platform > Platform updates > Check for updates.

Four-eyes. A procedure marked Four-eyes is held after you submit it until a second person approves it under Approvals; then you execute it. See 1.3 Four-eyes approval.

Group	Entries
Operations	Overview, Environment, Assets, Compliance, Evidence, Hardening, Operations
Investigation	Stories, Forensics, Defense, Honeypots, FIM, Logs, Review queue, Playbooks, Approvals
Network & Data	Network, Firewall, DLP, AD assessment
Administration	Settings (tabs: Platform, Setup, Notifications, Users, Access control, Authentication, API keys, SIEM forwarding, Audit trail, and Sandbox where demo data is allowed)

You see only the entries your role allows and your licence includes.

Chapters#

Part A: the server and the `./lawliet` command#

Chapter	Covers
1. Overview and concepts	What runs where, roles and permissions, four-eyes, the licence, the air-gapped model
2. Installation	Requirements, download and checksum, install by IP or name, certificate choices, first sign-in, two-factor, second approver, licence activation
3. CLI reference	Every `./lawliet` command and option, with examples and what the output means
4. Updates, rollback and delta updates	Updating from a file or the console, post-update steps, rolling back, deltas
5. Backup and restore	What a backup holds, scheduling, off-server copies, restore, restore onto a new server, testing
6. TLS and certificates	Checking, replacing and re-issuing certificates with agents online, hand-over, cancel, encryption on and off
7. Doctor, diag and support	Findings and safe fixes, the redacted diagnostics archive, health endpoints, contacting support
8. Troubleshooting	Symptom, cause, fix: start-up, console access, certificates, agents, clocks, WinRM, sign-in
9. Security hardening of the server	Ports, host firewall, shell access, secret files, console accounts, settings to keep

Part B: agents and identity#

Chapter	Covers
10. Agents overview	What the agent does, how it talks to the server, the Environment page, host configuration, clocks, removal, versions and upgrades
11. Install agents on Linux (and macOS)	Copy-paste command, offline package, installer options, managing and uninstalling the agent, macOS
12. Install agents on Windows	Copy-paste command, offline package, Group Policy (MSI and startup script), preparing hosts for WinRM, uninstall, installer parameters
13. Remote deployment from the console	Permissions and four-eyes, credentials, testing a credential, Kerberos realms, deploying agents
14. Active Directory	Directory sign-in, directory sync, Windows sign-in (Kerberos single sign-on), AD assessment
15. Users, roles, two-factor, API keys, approvals and the audit trail	Day-to-day account and approval administration
16. Agent security	Self-protection, uninstall codes, the recovery key, agent tokens, enrolment secret and codes, certificate changes

Part C: the console, area by area#

Chapter	Covers
20. Console basics, the Overview and the wall	Layout, banners, the Overview page, the wall
21. Review queue	The shared work list
22. Compliance: scans, results and the fix plan	Running scans and reading results
23. Compliance: schedules and drift	Scheduled scans, drift
24. Compliance: heatmap and trends	Control-by-scan view, history
25. Compliance: attestations, exceptions and reports	Attestations, exceptions, scheduled reports
26. Hardening	Fix plans, executions, rollback
27. Evidence bundles	Creating and exporting evidence
28. Network: discovery, topology map and exposure	Discovery, the map, exposure
29. Firewall	Supported firewalls, devices, findings, optimisation plans, applying a plan, versions, monitoring
30. Logs: search, dashboards and sources	Search, dashboards, what agents send, log sources
31. Logs: detection rules, alerts, Sigma, entities and ATT&CK	Detection rules, alerts, Sigma import, entities, ATT&CK coverage
32. Data loss prevention (DLP)	Incidents, policies, discovery of data at rest, where a file is, enforcement status
33. File integrity monitoring (FIM)	FIM policies, baselines and verification, working the changes
34. Forensics and IOC hunts	Cases, collecting evidence, artifacts and chain of custody, the super-timeline, IOC hunts
35. Honeypots (deception)	Decoy kinds, creating and deploying decoys, handling a trip, auto-contain
36. Active defense and containment	Containment actions, dispatching and undoing them, running a command on a host
37. Playbooks	How a playbook runs, creating one, approving a containment step
38. Assets and Stories	The asset inventory and the incident stories
39. Operations and Settings	Operations, every Settings tab, outbound email, notifications, SIEM forwarding, sandbox

Appendices#

Appendix	Covers
A. Action index	Every action in the CLI, on the hosts and in the console, with where it is, the permission, four-eyes, and the section with its procedure; the lifecycle of every object you can create
B. Permissions, roles and four-eyes	Every permission, what it allows, which built-in roles hold it, and the critical actions that need a second administrator
C. Glossary	The words the guide and the console use

I want to...#

Task	Go to
Install Lawliet on a new server	2. Installation
Install the licence I received	2.10 Activate the licence
Add agents	10. Agents overview
Give a colleague access, or create the second approver	2.9 First sign-in, step 5, 15. Users and roles
Apply an update	4. Updates
Undo an update	4.6 Roll back
Take or restore a backup	5. Backup and restore
Replace or renew the certificate	6. TLS and certificates
Find out why something is broken	8. Troubleshooting, then 7. Doctor and diag
Send diagnostics to the vendor	7.2 diag
Recover a locked-out administrator	3.17 passwd
Remove or delete a host	10.7 Removing a host, then uninstall it (11.6, 12.9)
Uninstall a protected agent	16.3 Uninstall codes
Disable or delete a user, or reset a forgotten password	15.2 Users
Find any button or command	Appendix A. Action index
Find out what a permission allows	Appendix B. Permissions

Contacts#

Help and support: [email protected]. Quote the build id from sudo ./lawliet status.
Security vulnerabilities only: follow the security disclosure page.

Reference documents#

Background and design notes behind the procedures: the lawliet command, networking, access control, diagnostics, certificate and licence health.