Skip to content
hbs-tool.
Documentation02 of 07

First scan walkthrough

From zero to your first reviewed server report in about 15 minutes, entirely in the browser.

≈ 2 min read

This walkthrough takes one dashboard machine and one target server (here: Ubuntu) from nothing to a reviewed, exported report. Every step except copying files is a click in the browser.

Step 1: start the dashboard (5 minutes, one time)

on the machine that will store the reports

curl -fsSL https://raw.githubusercontent.com/PotenFYR-Studios/HBS-Tool/main/scripts/install.sh | bash

The installer finishes with the console address (http://127.0.0.1:3000 on this machine) and one-time superuser credentials. Open the address in a browser, sign in, and change the password under Admin → Users.

Step 2: campaign, location, extractor (2 minutes)

  • Campaigns → New campaign → name it (e.g. "First look") → add a location (e.g. "Office").
  • Open the campaign → Locations & Hosts → Generate extractor.
  • Platform: linux-amd64 (or windows-amd64 for Windows servers) → download the binary.

Info

The downloaded file is tied to this issuance: it expires on schedule, can be revoked from the same page, and its reports can only be decrypted by this dashboard.

Step 3: scan the target server (2 minutes)

copy the binary to the server, then on the server

chmod +x hbs-extractor
./hbs-extractor --no-elevate --quiet

Unprivileged, offline, and done in about two minutes for the full catalog. It leaves exactly one new file next to itself: hbs-report-*.hbs. Copy that file back to the dashboard machine.

Step 4: upload and see results (1 minute)

Back in the browser: Locations & Hosts → drop the .hbs into the upload zone. The host appears within seconds and the console notifies you when ingestion finishes. Then look at:

  • Overview: KPI tiles and the severity donut for what was just ingested.
  • Remediation: the concrete fix list, ordered by severity, with copyable commands.
  • Executive Summary: the same result as a one-page narrative, ready to print or save as PDF.

Step 5: what to do next

  • Add more locations and generate one extractor per site; batch-upload a whole fleet of reports at once (up to 32 files per drop).
  • Fix something on the server, scan it again, upload: previously open findings that now pass are auto-resolved, and the diff is kept per host.
  • Record accepted risks on the Treatment board so they stop counting as open findings.
  • Invite teammates as auditor or viewer under Admin → Users; everyone works in the browser.

Tip

Report did not arrive? Run the extractor without --quiet to see progress, and check the Troubleshooting section of the README. Push failures never lose data: the local report is always kept.