IT & Sécurité

IT and security

The inventory of your IT, your passwords and the audit of your security.

In preparation Create an account

IT & Security lists the company's workstations, servers and software, keeps shared passwords in a vault, and regularly checks the exposure of your system.

IT & Sécurité is in preparation. It will join the Prophetix subscription catalogue when it is released.

Every feature of IT & Sécurité

57 features in 12 areas

IT estate inventory (CMDB)

Lists servers, workstations, network equipment, applications, databases, services, virtual machines and storage.
Describes each item: status, criticality, environment, owner, team, location, lifecycle and purchase dates, supplier, contract.
Adds your own item types and attributes.
Keeps the history of an item's changes.
Searches and filters by type, entity, status, criticality or environment.

Relationships and impact analysis (CMDB)

Shows the relationships between items: depends on, runs on, contains, uses, connected to, backup of.
Shows the estate as a graph, and each item's page from the graph.
Answers "if this one goes down, what stops?" through upstream and downstream impact analysis.

Tickets and deadlines (CMDB)

Tracks incidents, requests, changes and problems, with priority, impact and urgency.
Assigns to an agent or a team, links the ticket to the item concerned, and exchanges public or internal comments.
Defines service deadlines (SLA) by priority, with weekends and public holidays excluded.
Calculates the response and resolution due date of each ticket, and flags those that are approaching.

Organization and access (CMDB)

Arranges subsidiaries, sites and departments in a tree, and gives each person access to certain entities.
Manages teams and agents, with each one's maximum ticket load.
Summarizes activity in a dashboard: tickets, tickets close to their deadline, critical items.
Keeps each organization separate and switches to view-only without a license.

Encrypted compliance vault (CMDB)

Keeps content linked to the items in a vault reserved for the compliance department, encrypted in the browser.
The server keeps only encrypted text; a holder approves the access of new ones.
Provides for an offline recovery key and rotation of the vault key.

Password vaults (Vault)

Stores passwords, SSH keys, API keys, databases, cards, notes and identities in vaults and folders.
Never shows a secret in a list: it is displayed for thirty seconds or copied.
Generates passwords, encrypts secrets, and moves entries between vaults.
Shares by person, with read, write or administration rights.
Imports a KeePass database after a preview showing no secrets.
Searches everywhere, by favorites or by entries about to expire.
Calculates TOTP codes, displayed with a countdown, and copyable in one click.

Privileged access to servers (Vault)

Opens an SSH or PowerShell-over-SSH session in the browser, without ever handing over the credential.
Opens a remote desktop (RDP) in the browser, with a strip showing the name, email and UTC time.
Records sessions, encrypted, announced from the first line, and replayable only by the vault's administrators.
Allows a running session to be cut, and a terminal to be watched live, read-only, with a notice to the person watched.
Remembers the server's key or certificate on first connection and refuses a different one.
Logs every access, never keeping the value of a secret, and exports the history as CSV or JSON.

Security audit (Audit)

Runs scans of Active Directory, workstations, network and applications, or a quick scan that chains them all.
Active Directory: password policies and privileged accounts of a chosen domain.
Workstations: antivirus, firewall and BitLocker of a chosen workstation.
Network: open ports and SSL/TLS over an address range (CIDR).
Applications: vulnerable packages and CVEs in an applications folder.
Classifies each finding by severity (critical, high, medium, low, information).
Calculates an overall security score from 0 to 100.

Tracking, remediation and reports (Audit)

Displays a dashboard: score, vulnerabilities by severity, recent vulnerabilities, score trend.
Warns live of a new vulnerability and of the end of a scan.
Keeps the history of scans, with filters by status and by type, and exports the findings as CSV or JSON.
Prepares PowerShell remediation scripts, which you review, export one by one or all together, and run yourself.
Marks a vulnerability as fixed, with notes.
Produces PDF or Excel reports, filtered by period, severity and scan type.

On your devices

CMDB and Vault: in the browser, on a computer or a phone.
Audit: Windows desktop application.
Android: an authenticator app for one-time codes and sign-in approval, written but not yet published.

Good to know

Audit exists only as a Windows desktop application.
Scans are carried out by a separate audit service, which is not delivered in this repository; the workstation has not been verified end to end with it.
CMDB, SOC (which hosts the Vault) and Audit are today three separate applications, each with its own address.
Vault: the gateway has not been tried with a real Windows server; live observation does not cover remote desktops.
CMDB: relationships are displayed but the web version does not yet have a screen to create them; workflows cannot be used yet.
A session recording shows everything that is displayed: it requires prior information to the people concerned and, depending on the country, consultation of their representatives.

Planned (not available yet)

Access request with approval before a privileged session (Vault).
Synchronization with Active Directory to feed the inventory (CMDB).
Screens specific to changes and problems (risk, plans, root cause) in tickets (CMDB).