TacitSoft Diagnostics

Collector Catalog

Public metadata for safe, inspectable diagnostic collectors. Each collector generates a local bundle that should be reviewed before upload.

Catalog schema

2026.06

Bundle schema

2026.06

Machine metadata

collectors.json

k8s-resource-audit

Kubernetes Resource Audit

v0.2.0 public-preview

Collects customer-confidential Kubernetes operations, optional usage samples, Pending-pod forensics, version-lifecycle, metadata-only security posture, and offline image supply-chain signals through the supported SaaS evaluator contract.

Safety level: Level 2: sensitive cluster configuration inventory; internal review required
Bundle Contract: 1.0.0 · bundle schema 2026.06
Download metadata: tar.gz release bundle · SHA-256 bf1cf65eac994d0caf9006ee8d2e4ffb7d327254e1d6b297347fde5323dbfa2e · checksum-published unsigned public preview
Execution policy: Local-only collection · explicit upload required · remediation disabled
Bundle spec: 0 raw artifacts · 0 normalized outputs · dry-run fixture available
Download links: Artifact Checksums Release notes
Signing key: https://github.com/tacitness/tstools/tree/main/signing

Collects

Cluster and namespace resource inventory
Exact Kubernetes, k3s, runtime, node OS, kernel, and kubelet versions
Warning events, best-effort k3s certificate status, and filtered security-relevant kubelet warnings
Workload requests, limits, replicas, and scheduling metadata
PodScheduled conditions, container waiting states, and namespace events
PVC, PV, StorageClass, service, ingress, and configuration references
Deployment, StatefulSet, DaemonSet, Job, and ReplicaSet owner chains
Privileged execution, host access, container security context, and service-account metadata
Pod Security Admission, NetworkPolicy, RBAC, service exposure, and ingress TLS metadata
Pod and controller image references, resolved digests, and pull failures
Optional normalized local Syft, Grype, Trivy, and version results
Service, ingress, storage, and configuration references
Optional node and per-container usage samples from the metrics API
Machine-readable capability coverage and advisor input index

Does not collect by default

Kubernetes Secret objects or values
Certificate private keys or certificate contents
Unfiltered node or workload journals
Workload environment values or arbitrary annotations
Registry credentials, Docker authentication configuration, or raw scan artifacts
Container filesystem contents
Live workload traffic

Release flow

public-preview · published 2026-08-08

Install

curl -fsSLO https://tacitsoft.dev/downloads/collectors/k8s-resource-audit/0.2.0/k8s-resource-audit-0.2.0.tar.gz
curl -fsSLO https://tacitsoft.dev/downloads/collectors/k8s-resource-audit/0.2.0/SHA256SUMS
sha256sum -c SHA256SUMS
tar -xzf k8s-resource-audit-0.2.0.tar.gz
./k8s-resource-audit/install.sh --prefix ./out/k8s-resource-audit

Dry run

./k8s-resource-audit/install.sh --dry-run --prefix ./out/k8s-resource-audit
./out/k8s-resource-audit/run-collector.sh --dry-run --output ./out/k8s-bundle

Bundle expectations

The bundle is created locally under the output path and is not uploaded automatically.
bundle.json identifies collector, schema, and contract versions, cluster context, safety flags, and capability coverage.
Raw inventory is customer-confidential: bundle.json sets contains_sensitive_data=true and handling_state=raw.
upload_safe_after_review permits controlled internal upload only; it never makes raw content customer-shareable.
redaction/coverage.json records raw, redacted, omitted, or not-collected status for every artifact class.
bundle.json and redaction/coverage.json are included in the manifest and checksum chain.
Files left under raw/ remain raw regardless of a conflicting coverage claim.
raw/ contains sanitized Kubernetes metadata without Secret objects or values, environment values, arbitrary annotations, or live traffic capture.
Reports identify checks unavailable because optional collector capabilities were missing.

Source references

docs/collectors/k8s-resource-audit-contract.md
docs/strategies/cmmc-stig-diagnostics-saas-platform.md
docs/strategies/tacitsoft-full-spectrum-strategy-map.md

linux-baseline

Linux Baseline

v0.1.0 metadata-preview

Collects Linux host baseline facts used to assess hardening posture before deeper compliance mapping.

Safety level: Level 3: host configuration and hardening signals
Download metadata: shell collector bundle · SHA-256 pending-release-sha256 · placeholder-pending-signed-release
Execution policy: Local-only collection · explicit upload required · remediation disabled
Bundle spec: 13 raw artifacts · 4 normalized outputs · dry-run fixture available
Signing key: https://github.com/tacitness/tstools/tree/main/signing

Collects

OS release, kernel, package, service, and account posture metadata
Filesystem, mount, network listener, and firewall summaries
Selected security configuration files and normalized findings
Collector log, manifest, and checksums

Does not collect by default

Private keys or credential stores
User home directory contents
Application databases

Source references

docs/strategies/cmmc-stig-diagnostics-saas-platform.md
docs/strategies/tacitsoft-full-spectrum-strategy-map.md

ubuntu-stig-preflight

Ubuntu STIG Preflight

v1.0.0 public-preview

Collects Ubuntu STIG and CMMC readiness evidence for SSHD, PAM, auditd, sudo, sysctl, AppArmor, AIDE, chrony, and session-timeout review without applying remediation changes.

Safety level: Level 3: Logs or identity/auth data, strong redaction required.
Bundle Contract: 1.0.0 · bundle schema 2026.06
Download metadata: tar.gz shell collector release · SHA-256 b33ee1e39c77582dd854c87f647c38dcfc4840bf9d7eddc3b719e4a7078d71ad · checksum and detached release signature published
Download links: Artifact Checksums Release notes
Signing key: /downloads/collectors/ubuntu-stig-preflight/1.0.0/release-signing.pub

Collects

Ubuntu release, kernel, package, service, and STIG baseline facts
Sanitized SSHD, PAM, auditd, sudo, sysctl, AppArmor, AIDE, and chrony posture
USG/SCC/STIG readiness inputs and dry-run evidence references where present
Authentication transition and rollout-risk indicators needed for human remediation planning
Collector manifest, checksums, normalized findings, and review-ready evidence inventory

Does not collect by default

Password hashes
Private SSH keys
Automatic remediation output
Secrets from application stores or user home directories
Hostnames, usernames, account names, internal endpoints, or policy principals
Assessment submissions to STIGViewer, eMASS, or third-party portals

Release flow

public-preview · published 2026-08-12

Install

curl -fsSLO https://tacitsoft.dev/downloads/collectors/ubuntu-stig-preflight/1.0.0/ubuntu-stig-preflight-1.0.0.tar.gz
curl -fsSLO https://tacitsoft.dev/downloads/collectors/ubuntu-stig-preflight/1.0.0/SHA256SUMS
curl -fsSLO https://tacitsoft.dev/downloads/collectors/ubuntu-stig-preflight/1.0.0/SHA256SUMS.sig
sha256sum -c SHA256SUMS
tar -xzf ubuntu-stig-preflight-1.0.0.tar.gz
./ubuntu-stig-preflight/install.sh --prefix ./out/ubuntu-stig-preflight

Dry run

Source references

docs/strategies/cmmc-stig-diagnostics-saas-platform.md
docs/strategies/tacitsoft-full-spectrum-strategy-map.md

Readiness surfaces

SSHD hardening posture

review-required

Control families: AC, IA, SC

raw/sshd/sshd-t.txt
raw/sshd/sshd-config.txt

PAM authentication and faillock posture

review-required

Control families: AC, IA

raw/pam/common-auth.txt
raw/pam/common-password.txt
raw/pam/faillock.conf.txt

auditd service, rules, and lockout state

review-required

Control families: AU

raw/auditd/audit-summary.txt

sudo policy and logging posture

review-required

Control families: AC, AU

raw/sudoers/sudoers.txt
raw/sudoers/sudoers-d.txt

Kernel sysctl network hardening state

lower-sensitivity

Control families: CM, SC

raw/sysctl/sysctl-a.txt
raw/sysctl/99-sysctl.conf.txt

AppArmor enforcement status

lower-sensitivity

Control families: CM, SI

raw/apparmor/aa-status.txt
raw/apparmor/enabled.txt

AIDE package and baseline readiness

review-required

Control families: CM, SI

raw/aide/package-status.txt
raw/aide/aide.conf.txt

chrony time sync posture

lower-sensitivity

Control families: AU, SC

raw/chrony/chronyc-sources.txt
raw/chrony/chrony.conf.txt

Shell session timeout enforcement

lower-sensitivity

Control families: AC

raw/session-timeout/profile.txt
raw/session-timeout/profile-d.txt

Bundle schema and review profile

bundle_schema_version: 2026.06
collector_name: ubuntu-stig-preflight
collector_version: 1.0.0
host_count: Single host today; fleet aggregation later
platform: ubuntu
contains_sensitive_data: true
upload_safe_after_review: true
customer_notes: optional
handling_state: raw

Sensitivity profile: Level 3: Logs or identity/auth data, strong redaction required.

Review and redact identity, authentication, and security configuration artifacts before upload.

Review-required paths

raw/sshd/
raw/pam/
raw/sudoers/
raw/auditd/
raw/aide/

Upload notes

Treat effective SSHD, PAM, sudoers, and auditd outputs as sensitive even when they do not contain secrets.
Redact hostnames, email addresses, IP addresses, account names, and internal pathing if they are not required for review.
Keep bundle.json, manifest.json, checksums.sha256, and normalized findings consistent after any redaction step.

Upload review expectations

1.Confirm the bundle is from the intended Ubuntu host and that bundle.json still reports contains_sensitive_data=true before upload.
2.Review raw authentication and authorization artifacts for service-account names, internal domains, bastion hostnames, and network ranges.
3.Verify collector.log only shows dry-run inspection commands and no remediation mutation steps.
4.Document any omitted files or redactions in redaction/notes.md so later control mapping can distinguish missing evidence from noncompliance.

Sample output inventory

Fixture: docs/collectors/ubuntu-stig-preflight-sample-output-inventory.json

bundle.json manifest.json raw/os-release.txt raw/sshd/sshd-t.txt raw/pam/common-auth.txt raw/auditd/rules.txt raw/sudoers/sudoers-d.txt raw/sysctl/sysctl-a.txt raw/apparmor/aa-status.txt raw/aide/aide.conf.txt raw/chrony/chrony.conf.txt raw/session-timeout/profile-d.txt normalized/findings.json reports/review-notes.md redaction/notes.md

cmmc-evidence-prep

CMMC Evidence Prep

v1.0.0 public-preview

Builds a control-family-oriented evidence-prep bundle for CMMC Level 2 readiness, audit artifact planning, and later control mapping.

Safety level: Level 3: compliance evidence preparation
Bundle Contract: 1.0.0 · bundle schema 2026.06
Download metadata: tar.gz shell collector release · SHA-256 39a1a084118f2018dd7617fdd629eeb2245d3cff3dea8e3b6684642a863fc008 · checksum and detached release signature published
Download links: Artifact Checksums Release notes
Signing key: /downloads/collectors/cmmc-evidence-prep/1.0.0/release-signing.pub

Collects

Control-family evidence inputs for access control, audit logging, configuration management, identification/authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, situational awareness, system communications protection, and system/information integrity
Policy, procedure, configuration, and audit-readiness file references
Evidence ownership, system boundary, and POA&M preparation metadata
Bundle manifest, checksums, and collector logs

Does not collect by default

Full policy repositories by default
Customer proprietary evidence unless explicitly added
Assessment submissions to third-party systems

Distinct scope

Separate from the generic Linux baseline: this track organizes artifacts around CMMC evidence expectations instead of broad host posture inventory.

Control families

Evidence artifact inventory

Ubuntu release metadata without host identity
Sanitized system and human account counts
Control-family policy and procedure references
Identity, access, MFA, and privileged account evidence pointers
Audit logging, retention, and review evidence pointers
Configuration baselines, change-control records, and exception notes
Vulnerability, patch, and remediation tracking snapshots
Incident response, media handling, and maintenance evidence references

Mapping hooks

ruleset:cmmc-l2-linux-evidence
report:evidence-pack
report:control-map
export:poam-seed
export:evidence-artifact-registry

Release flow

public-preview · published 2026-08-12

Install

curl -fsSLO https://tacitsoft.dev/downloads/collectors/cmmc-evidence-prep/1.0.0/cmmc-evidence-prep-1.0.0.tar.gz
curl -fsSLO https://tacitsoft.dev/downloads/collectors/cmmc-evidence-prep/1.0.0/SHA256SUMS
curl -fsSLO https://tacitsoft.dev/downloads/collectors/cmmc-evidence-prep/1.0.0/SHA256SUMS.sig
sha256sum -c SHA256SUMS
tar -xzf cmmc-evidence-prep-1.0.0.tar.gz
./cmmc-evidence-prep/install.sh --prefix ./out/cmmc-evidence-prep

Dry run

Source references

docs/strategies/cmmc-stig-diagnostics-saas-platform.md
docs/strategies/tacitsoft-full-spectrum-strategy-map.md

linux-crash-rca

Linux Crash RCA Preflight

v1.0.0 public-preview

Inventories and validates operator-selected Linux vmcore or user-space core evidence locally, without executing artifacts or uploading data.

Safety level: Level 4: crash memory and customer-provided evidence; private manual review only
Download metadata: tar.gz local preflight release · SHA-256 ebe9c6e7da776f048246411482abab94f5a0b5e6c70108c30273a9f0c3bb3fa7 · checksum-published unsigned public preview
Execution policy: Local-only collection · explicit upload required · remediation disabled
Bundle spec: 6 raw artifacts · 3 normalized outputs · dry-run fixture available
Download links: Artifact Checksums Release notes
Signing key: https://github.com/tacitness/tstools/tree/main/signing

Collects

Exactly one operator-selected kernel vmcore or user-space ELF core
Exact build ID, release, architecture, endianness, configuration, and module identity metadata
Optional symbols, debug info, logs, platform/hardware, container, source-map, and reproduction evidence
Local preflight report, capability matrix, manifest, checksums, sensitivity coverage, consent, and retention declarations

Does not collect by default

Files not explicitly listed in the local inventory descriptor
Kubernetes Secret objects or any live-cluster data
Cloud metadata, remote URLs, or automatic uploads
Executed cores, binaries, modules, symbols, or reproduction inputs

Release flow

public-preview · published 2026-08-08

Install

curl -fsSLO https://tacitsoft.dev/downloads/collectors/linux-crash-rca/1.0.0/linux-crash-rca-1.0.0.tar.gz
curl -fsSLO https://tacitsoft.dev/downloads/collectors/linux-crash-rca/1.0.0/SHA256SUMS
sha256sum -c SHA256SUMS
tar -xzf linux-crash-rca-1.0.0.tar.gz
./linux-crash-rca/install.sh --prefix ./out/linux-crash-rca

Dry run

./linux-crash-rca/install.sh --dry-run --prefix ./out/linux-crash-rca
./linux-crash-rca/run-collector.sh --inventory ./linux-crash-rca/example-inventory.json --source-root ./local-case --output ./out/crash-review --dry-run

Bundle expectations

The collector writes a local review directory and has no upload, cloud, network, or Kubernetes behavior.
Kernel vmcore and user-space core are distinct closed artifact classes and cannot be inferred from one another.
Every manifested file is relative, classified, bounded, exactly sized, and SHA-256 checksummed.
Identity mismatches block affected capabilities; missing evidence never upgrades confidence.
Core memory remains Level 4 secret evidence and customer_shareable=false after review.

Source references

collectors/linux-crash-rca/1.0.0/bundle-spec.yaml
docs/collectors/linux-crash-rca-v1.md
docs/issues/CUSTOM-BUNDLES-BUNDLESPEC.md

Bundle schema and review profile

Sensitivity profile: Level 4: Customer-provided sensitive bundle, never auto-share.

Core memory is always secret and private/manual-review-only; review never makes it customer-shareable.

Review-required paths

raw/core/
raw/logs/
raw/context/
raw/reproduction/

Upload notes

Inspect reports/preflight.json for non-identifying secret/PII flags and mismatched evidence before consent.
An unconsented bundle is intentionally rejected with consent_required.
Regenerate the manifest and checksum chain after any redaction; never relabel raw paths as share-safe.

Inspect the bundle before upload

Collectors write local artifacts first. Upload should happen only after the generated bundle has been reviewed and redacted as needed.

1 Open bundle.json and confirm the collector name, version, creation time, platform, sensitive-data flag, and handling state.
2 Review manifest.json and checksums.sha256 so the file list and hashes match the generated bundle.
3 Review redaction/coverage.json and treat every raw artifact class as customer-confidential and internal-only.
4 Inspect raw/ and normalized/ for secrets, tokens, keys, customer data, or other material that should be redacted before controlled upload.
5 Read collector.log for command failures or skipped checks before sharing the bundle.

Expected bundle contents

bundle.json manifest.json checksums.sha256 collector.log raw/ normalized/ reports/ redaction/ signatures/

Safety levels

Level 0: Metadata only, generally safe.

Level 1: System config, review recommended.

Level 2: Security config, sensitive, review required.

Level 3: Logs or identity/auth data, strong redaction required.

Level 4: Customer-provided sensitive bundle, never auto-share.