22 integrated modules connected by a shared AI brain. See each one in action — no stitching together separate tools required.
| Title | Host | Severity | Status | Detected | Action |
|---|---|---|---|---|---|
| SSH brute-force attack — 247 failures from 3.14.159.26 | centos9-prod-01 | CRITICAL | Investigating | 2 mins ago | |
| Memory pressure sustained — 91% usage for 15 min | rhel9-db-01 | CRITICAL | Playbook Gen | 5 mins ago | |
| Disk /var at 89% — projected full in 4 hours | rhel9-db-01 | HIGH | New | 8 mins ago | |
| CPU load average 87% — nginx worker congestion | ubuntu22-web | HIGH | Auto-Remediating | 12 mins ago | |
| openssl-3.0.7 CVE-2024-0727 — medium CVSS 5.5 | 4 hosts | MEDIUM | New | 1 hour ago | |
| Auth failure pattern — 3 sudo failures in 5 min | centos9-prod-01 | MEDIUM | Resolved | 3 hours ago |
Continuous log + metrics collection via SSH
SSH diagnostics, config reads, CVE cross-reference
Local LLM root cause analysis grounded in RAG docs
Ansible YAML + pre-emptive revert playbook
Risk-gated 1 or 2-tier human approval
Ansible playbook runs, full output captured
One-click undo from dashboard. Always available.
RHEL 9 & 8 administration, security, system mgmt
Playbook reference, modules, best practices
Server 22.04 LTS administration and security
K8s cluster management and security hardening
RHEL/Ubuntu/Debian hardening guides
Internal documentation and custom procedures
No integration tax. No stitching separate tools together. Every module shares the same AI brain, database, and audit trail.
AI agent investigates via SSH, reasons about root cause, generates Ansible playbooks, awaits approval, executes, and stores revert. Full autonomous loop.
Scans every package against NIST NVD, CISA KEV, and OSV.dev. Computes risk score 0-100. Auto-patches at configurable thresholds. Deterministic downgrade revert.
SSH log collection on cron schedule. LLM analyses every source — journalctl, /var/log/secure, app logs — classifying severity and identifying root cause.
ChromaDB vector store ingesting Red Hat, Ansible, Kubernetes, Ubuntu and your own documentation. AI answers grounded in real vendor docs — no hallucinations on infrastructure decisions.
LLM generates targeted Ansible YAML for every detected issue, including pre-emptive revert. Two-tier approval (standard + security officer sign-off) for sensitive changes.
Baselines security-critical files (sshd_config, sudoers, PAM, sysctl, fstab) via SSH. Periodic re-scan surfaces drift. Acknowledge expected, escalate unexpected.
CIS Benchmark-aligned checks via SSH. Per-host posture score trending over time. LLM generates remediation steps for each failed check.
When multiple hosts surface issues simultaneously, the LLM correlates events across the fleet to identify cascade failures and shared root causes.
Context-aware chat backed by your knowledge base. Ask infrastructure questions in plain English, get answers grounded in real system state and vendor documentation. Works fully offline.
Describe what you want in plain English — "restart nginx on all web servers after clearing logs" — and LocalM generates valid, safe Ansible YAML instantly with streaming preview.
After every resolved incident, LLM generates a structured post-mortem: timeline, root cause, contributing factors, impact, and remediation steps. Markdown export.
Pattern-based suppression rules intelligently mute repetitive low-value alerts. Maintenance windows pause monitoring. On-call briefings delivered on demand in 30 seconds.
Every capability is backed by a local LLM running via Ollama — no cloud API, no data exfiltration. Here is exactly what the AI does in each module.
| Capability | What the AI does | Stack |
|---|---|---|
AI Chat AssistantRAG-augmented Q&A |
Your question is converted to a vector embedding. ChromaDB retrieves the most relevant passages from ingested vendor docs. Those passages are injected as context into the LLM prompt — so the model answers from real documentation, not hallucinated guesses. Works 100% offline. | Ollama LLMnomic-embed-textChromaDBLangChain |
CVE Scoping & PrioritisationRisk scoring & fleet context |
Raw CVE data from NVD, CISA KEV, and OSV is cross-referenced against your fleet's installed packages. The LLM contextualises each finding — explaining exploitability, ranking by asset criticality, and generating a plain-English risk summary for each affected host — so engineers act on the right CVEs first. | Local LLMNIST NVDCISA KEVOSV.dev |
Remediation Playbook GenerationAnsible / PowerShell / CLI |
For every detected issue or CVE, the LLM writes a targeted playbook from scratch — Ansible YAML for Linux, PowerShell for Windows, CLI sequences for network devices. Each playbook includes a pre-emptive revert so any change can be deterministically undone in seconds. | Ollama LLMLangChainAnsiblePowerShell |
Autonomous Remediation LoopAutonomous multi-step execution |
The LLM drives a multi-step state machine: SSH-investigate the host → reason about root cause (grounded in RAG docs) → select the appropriate action → generate a playbook → present for approval → execute → verify the fix. Every decision, every step, every output is logged to the immutable audit trail. | LangChain AgentOllama LLMState MachineRAG Context |
Log Analysis & TriageScheduled LLM sweep |
On every cron cycle, SSH log collection pulls journalctl, /var/log/secure, /var/log/messages, and app-specific logs from every host. The LLM reads every source, classifies severity (INFO / WARN / CRITICAL), identifies root cause, and surfaces only actionable findings — eliminating noise from the alert queue. | Ollama LLMAPSchedulerSSH CollectionSeverity Classify |
Compliance GuidanceCIS Benchmark remediation |
After each SSH-based CIS Benchmark check, the LLM generates plain-English remediation steps for every failed control — referencing the specific standard, explaining the security rationale, and producing the exact config change needed. Engineers get a fix, not just a finding. | Local LLMCIS BenchmarksSSH Checks |
Causal Chain AnalysisCross-host correlation |
When multiple hosts surface issues simultaneously, the LLM correlates events across the fleet to distinguish a cascade failure from independent incidents — identifying the upstream root cause, the blast radius, and predicting whether SLAs are at risk before engineers even begin investigating. | LLM CorrelationCross-Host ContextSLA Predict |
Auto Post-MortemsIncident documentation |
After each resolved incident, the LLM generates a structured post-mortem from the audit trail — covering timeline, root cause analysis, contributing factors, impact assessment, and remediation steps taken. Markdown export for Confluence, Jira, or internal wikis. Zero manual write-up time. | Ollama LLMAudit TrailMarkdown Export |
Natural Language → PlaybookPlain English to YAML |
Engineers describe intent in plain English — "restart nginx on all web servers after rotating logs". The LLM translates directly to valid Ansible YAML with streaming preview, allowing iterative refinement in natural language before execution. No YAML authoring required. | Ollama LLMLangChainStreamingNL → YAML |
Every LLM call runs on your hardware via Ollama (Llama 3.1, Qwen 2.5, Mistral, or any GGUF model). No OpenAI API. No Azure AI. No external call of any kind. Fully deployable in air-gapped environments. Bring your own model via the OpenAI-compatible API if you have an internal inference server.
45-minute technical demo with a live agentic session against a real Linux host. No slides — just the product working.