RHEL, Rocky, Oracle Linux, Ubuntu, Debian, SUSE, and Amazon Linux from one console on your own server. It knows which kernel is actually running, scans against DISA's STIG, and serves updates from its own cache. Flat yearly price.
| The job | In Gardience |
|---|---|
| Install updates | dnf on the Red Hat family, apt on Debian and Ubuntu, in rings, inside your change windows, with two-person approval when you want it |
| Kernel fixes | Gardience compares the kernel each machine is running with the newest one installed, and marks every machine that still needs a restart to be protected |
| Restart and verify | The Patch, reboot, wait, verify workflow restarts each machine in its window and waits until it is back before the run counts as done |
| Fix one CVE everywhere | Look up a CVE across the fleet and install only its fix, with dnf's own advisory data on the Red Hat family |
| Updates without internet | A built-in update cache for Debian, Ubuntu, Rocky, AlmaLinux, and EPEL: each package downloads once, machines need no internet |
Scan RHEL-family, SLES, and Ubuntu machines against DISA's STIG, see failed rules by severity, and download STIG Viewer checklists and an eMASS-ready POA&M. Gardience brings the Ubuntu 22.04 and 24.04 content itself.
STIG and CIS-aligned checks, auditd rules for sign-ins, account changes, sudo, and privileged commands, with a one-click fix and drift repair.
Every CVE on every machine, including Ubuntu and Debian kernel CVEs, known-exploited ones from CISA's catalog first, the rest ranked by how likely they are to be attacked.
A long random root password per machine, changed on a schedule and kept in the vault, with locked accounts left locked. LUKS drives get a recovery key Gardience holds.
fapolicyd on the Red Hat family, started in permissive mode, reviewed, then enforced from the console.
CrowdStrike, Defender, SentinelOne, Sophos, and other common products recognized, or ClamAV installed when you ask.
Gardience runs on open-source Salt. Your existing Salt states, keys, and agents keep working, on Salt 3006, 3007, and 3008 side by side. Ansible playbooks run over the same connection with no SSH keys to hand out. Ansible and Terraform.
RHEL 8, 9, and 10, Oracle Linux 8, 9, and 10, Rocky Linux 8 and 9, Ubuntu 20.04, 22.04, and 24.04, Debian 11 and 12, SUSE Linux Enterprise 15 SP6, and Amazon Linux 2023, each verified on real machines with the full product. Every supported platform.
1,020 Windows and Linux servers patched in 13 minutes in one approved run, every result in the audit log. See the proof.
Does it replace Red Hat Satellite or SUSE Multi-Linux Manager? For patching, hardening, and compliance, yes, and it covers Windows in the same console. Compare.
Can it run with no internet? Yes. There is an offline installer, and the update cache can be exported and carried into an isolated network.
Windows too? Yes, in the same console, on the same schedule. Gardience for Windows.
Can I try it on my own machines? Yes. The free license covers 10 machines with no time limit, and the trial covers the full product.