1. Install and open the dashboard

The dashboard runs on the machine you manage scans from (a workstation or server) and stores all data locally. The installers set it up as a background service and print the console address when done:

Linux / macOS

curl -fsSL https://raw.githubusercontent.com/PotenFYR-Studios/HBS-Tool/main/scripts/install.sh | bash

Windows (PowerShell)

irm https://raw.githubusercontent.com/PotenFYR-Studios/HBS-Tool/main/scripts/install.ps1 | iex

Open http://127.0.0.1:3000 on the machine running the dashboard. To reach it from another computer, start it with --host and open http://<dashboard-ip>:3000; add TLS (HBS_TLS_CERT / HBS_TLS_KEY) for anything beyond your LAN.

Info

On first launch the server creates a superuser account and prints its credentials once in the terminal or service log. Sign in with those and change the password under Admin → Users; after that everything happens in the browser.

2. Create a campaign and generate an extractor

Three levels: Campaign (the review, e.g. "Acme Q3") → Location (a site, e.g. "DC-East") → Issuance (one extractor binary locked to that campaign/location with its own encryption key and expiry).

Sign in and open Campaigns.
Click New campaign, give it a name, and add your first location.
Open the campaign, go to Locations & Hosts, and click Generate extractor.
Pick the platform of the machines you will scan (linux-amd64 or windows-amd64) and download the file. Reports it produces can only be opened by this dashboard.

3. Scan a server (offline, read-only)

Copy the extractor to the target server any way you already use (SCP, USB stick, network share) and run it there:

# Linux (amd64), unprivileged; report lands beside the binary
./hbs-extractor --no-elevate --quiet

# Windows (PowerShell/cmd)
hbs-extractor.exe --no-elevate --quiet

Tip

That is the whole scan: strictly read-only, no internet access, exactly one file written (hbs-report-*.hbs). On Windows, double-clicking the .exe also works; use --elevate for admin-only checks (declining the UAC prompt is safe).

4. Get the report into the dashboard

Manual upload (default): copy the .hbs file back, open Campaigns → your campaign → Locations & Hosts, and drag it into the drop zone (batch uploads up to 32 files).
Direct push (optional): copy the push token from the issuance page and run the extractor with --push https://<dashboard-host>:3000/api/ingest. This is the only situation in which the extractor touches the network.

The host appears immediately via live notification. Campaign and location are derived from the issuance, and re-scanning a server auto-resolves findings that now pass.

5. Read the results

You are...	Open...	You get...
`Management`	Executive Summary	One-page risk overview, plain-language narrative, print/PDF for the board
`Sysadmin`	Remediation	Every failing check grouped into fix actions with copyable commands
`Analyst`	Findings	Filter/pivot by host or check, open evidence, diff hosts against each other
`Auditor`	Standards + Treatment	CIS / NIST 800-53 / ISO 27001 / PCI-DSS coverage, accepted-risk board