Site appliance (early access)

Status: early access. Every collector is built and tested against simulated devices, but the appliance has not yet been run on a real client site, and its image is not yet available to download. Graften provides it to founding partners directly. Until it has run on real sites, treat what it reports as evidence to check, not a result to rely on.

What it is

A small virtual machine you run on a client's network (Proxmox or KVM, Hyper-V, or VMware). It reads security settings from the client's devices and sends Graften the results. Graften's cloud service can't reach a private network; the appliance can.

Use it when a client has servers, a domain, firewalls or switches worth reading from one place. The On-Prem Agent stays the better fit for a small client: it runs on each machine instead.

Rules it follows

• Read-only. It changes nothing on any device. If something fails it stops collecting; it never tries anything else.
• Approved ranges only. A device is contacted only if every address it resolves to is inside the ranges approved when you paired the appliance.
• Never-touch list. Addresses and ranges on the list are never contacted, even inside the approved ranges, and the appliance's own firewall blocks them as well.
• Certificates and SSH host keys are always checked, against a pinned fingerprint or a trusted certificate authority. There is no "accept anything" setting.
• Passwords and tokens are encrypted to the appliance. You enter them in the portal, and your browser encrypts each one to that appliance's own key before it is sent. Graften stores and passes on only the encrypted form; only the appliance can open it. Compare the key's fingerprint once (see Collector settings) so you know it is that appliance's key.
• Only results are sent. Raw device output never leaves the appliance.
• Unknown is never a pass. Anything it couldn't read is reported as unavailable, and Graften shows it as not assessed.
• Essential Eight stays your attestation: the appliance shows evidence beside it but never answers it.

Pairing

1. In the portal, open the client, then Connections and Site appliances, and click Create pairing code. The code is shown once and expires after 24 hours.
2. Start the appliance and, on its console, choose Pair with Graften. Enter the code, the address ranges it may contact, and the never-touch list.
3. The appliance appears under Site appliances for that client.
4. Click Collector settings on it and choose what it collects (see below).

Run the appliance on a host that is always on: a server, NAS or hypervisor that never sleeps. On a laptop or desktop that sleeps, the VM is frozen while the host sleeps, so the appliance stops reporting, and machines it reads can wake with their clocks hours out. On Hyper-V, give the VM fixed memory (2 GB) rather than Dynamic Memory, and bind its virtual switch to a wired adapter rather than Wi-Fi.

There is no SSH or shell login. The console menu covers status, network settings, pairing, the approved ranges and never-touch list, restart and shut down, so whoever can open the VM's console in the hypervisor administers the appliance.

What it read

Click Readings on an appliance to see, for each host, every reading from its latest run exactly as read, or "not measured" with the reason. Use it to check a value against the machine. Under the appliance, Could not measure lists the readings it could not take and why (for example a host that refused the sign-in). Neither counts as passed or failed. When you remove a host or turn a collector off, its readings stop counting straight away.

Collector settings

Choose what an appliance collects in the portal: open the client's Site appliances and click Collector settings. Turn on each collector you want, add its hosts and the read-only account it signs in with, and click Save and send to the appliance. The appliance checks for new settings every two minutes. It checks them before using them, runs every collector once straight away, and the page shows whether the settings are running or why the appliance refused them. Anything it could not collect appears under Could not collect.

• Passwords and tokens are encrypted in your browser to that appliance's own key. Leave a password box blank to keep the one already stored. The page shows the key's fingerprint; the first time, check it matches Encryption key on the appliance console's Status screen.
• Linux hosts: add the host and leave its fingerprint empty. After you save, the appliance reads the host's SSH key without signing in, and the page shows it. On the host, run ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub. If the SHA256 value matches, click It matches: pin this key and save again. The password is only sent to a host whose key you've confirmed.
• Windows hosts need Graften's read-only PowerShell endpoint installed first, and an account without admin rights. Download the endpoint package from these settings (Download the Windows endpoint package, under Windows hosts): it is the one released with the version this appliance runs, signed by Graften, with its SHA-256 shown.
• The approved ranges and the never-touch list can't be changed here. They are shown on the page, and you change them on the appliance's console (Approved ranges and never-touch list). That way nothing done in Graften can widen where the appliance goes on a client's network.
• Saving needs an account admin. If the appliance was set up by editing its settings on the console, the page loads those settings the first time, and passwords stored on the console keep working until you enter new ones.
• If an appliance ever reports a different encryption key from the one it paired with, Graften stops sending it settings and the page says so. Revoke it and pair it again if it was reinstalled; otherwise treat it as compromised.

What it collects

It reports its own status every hour. Collectors that sign in to the client's systems (Windows, Active Directory, network devices, firewalls, Linux, network services, discovery and the exposure scan) run once a day, backups every 6 hours and hypervisors every 12. Each schedule can be changed per collector.

Not yet supported: WatchGuard and Forcepoint firewalls, and macOS hosts.

Domain controllers without a certificate can be read with the Kerberos connection. The account's password is never sent: it is used only to get a Kerberos ticket from the domain controller being read, on TCP port 88 at the same approved address. The domain controller must prove its identity, and everything after sign-in is encrypted; if the domain controller does not offer an encrypted session, the appliance stops rather than read in clear. Only AES is used. Enter the domain controllers' DNS names (such as dc1.corp.example.com), not addresses, and keep the appliance's clock within five minutes of the domain's. Kerberos needs appliance version 0.2.2 or later, and has been tested against Windows Server 2025 and Samba domain controllers.

Domain controllers with a certificate from the domain's own certificate authority (Active Directory Certificate Services) can be read over LDAPS or StartTLS. Export the authority's certificate in Base-64 (PEM) form and paste it under Certificate authority in the Active Directory settings. Only certificates are accepted: Graften refuses a private key, and a domain controller's own certificate. The appliance still checks each domain controller's name against its certificate. This needs appliance version 0.2.5 or later.

Use a read-only account for every device it signs in to. Each collector's setup lists the role to use.

Windows hosts

Each Windows host needs Graften's read-only endpoint (the Windows endpoint package, downloaded from the appliance's Windows hosts settings in the portal; one host at a time with Install-GraftenJea.ps1) and a collection account with no administrator rights. The appliance can run only the one read-only command the endpoint offers.

Treat the collection account like any other service account, and the same goes for every account the appliance signs in with: keep it under the client's normal password policy rather than exempting it. (Graften flags administrator accounts whose passwords never expire, and the same reasoning applies.) When its password changes, enter the new one in the appliance's settings in Graften; the next collection uses it. Until then the old password is refused, and the appliance tries it at most once a day so it never locks the account out. Readings it cannot take are shown as not assessed, never as passed, and a failure it measured before still counts for up to 8 days.

Use HTTPS on real sites: install with -EnableHttps, which sets WinRM to listen on port 5986 and prints the certificate's SHA-256 fingerprint. In Collector settings, tick Use HTTPS and enter each host with its fingerprint; the appliance then accepts that certificate and no other. Over plain HTTP (port 5985) the sign-in method protects the traffic only with a weak cipher (RC4). Allow the WinRM port from the appliance's address only, and give the appliance a fixed address.

On machines managed by Intune or a security baseline, local accounts are often not allowed to sign in over the network ("Deny access to this computer from the network"). Use a domain account there, or the Graften on-premises agent. Do not loosen the baseline for Graften. Laptops that are rarely on the office network are better covered by Intune through the client's Microsoft 365 connection, which needs nothing installed.

Windows 11 and other client editions are supported, tested on Windows 11 (build 26300) joined to a domain. Client editions block scripts by default; the endpoint allows its own signed-in session to load Graften's module and leaves the computer's execution policy unchanged. Use appliance 0.2.6 or later. A computer without BitLocker installed (most servers) is reported as not measured for disk encryption, never as encrypted.

Setting up every computer in a domain

Deploy-GraftenJea.ps1, in the same package, sets up the endpoint on each computer at startup, from a Group Policy startup script or your RMM tool, so nothing is installed by hand. It is safe to run at every startup: it changes nothing unless the package, the group or the appliance's address changed, and records each run in the Application event log (source Graften: 100 up to date, 101 installed or updated, 900 failed, with the reason). It turns PowerShell remoting on only where it is off, and then switches Windows' own WinRM firewall rules off again, so port 5985 is open to the appliance's address only. It never stores a password.

1. Download the package from the portal, check its SHA-256 with Get-FileHash, and copy the files in its GraftenJea folder to \\<domain>\NETLOGON\GraftenJea on a domain controller.
2. Create a group, for example GraftenCollectors, with the collection account as its only member and no other rights.
3. Create a Group Policy object linked to the OUs that hold the computers. To read domain controllers too, link it to the Domain Controllers OU as well; don't move them out of it.
4. Under *Computer Configuration → Policies → Windows Settings → Scripts → Startup → Scripts*, add powershell.exe with these parameters: -NoProfile -NonInteractive -ExecutionPolicy Bypass -File \\<domain>\NETLOGON\GraftenJea\Deploy-GraftenJea.ps1 -CollectorGroup "<DOMAIN>\GraftenCollectors" -ApplianceAddress <appliance IP>. Use double quotes in this box: single quotes are passed on as part of the value. The execution policy applies to this one run only.
5. Each computer sets itself up at its next restart. With an RMM tool, copy the three files to the computer and run the same command as SYSTEM; exit code 0 means done or already up to date.

This sets up HTTP (port 5985). HTTPS needs each computer's certificate fingerprint entered in Graften, so it is not part of the domain-wide setup yet.

Then, in the appliance's Windows hosts settings, tick Read every Windows computer in the domain instead of listing hosts (appliance 0.2.7 or later, with Active Directory set up). Each collection lists the enabled Windows computers that signed in within the stale-account period (90 days unless you change it), up to 2,000 per domain, and reads those inside the approved ranges. Computers outside the ranges are counted and reported, never contacted.

Discovery and the exposure scan

These are the only collectors that contact every address in the approved ranges, which is why both are off until you switch them on. They open plain connections gently (one at a time per address, with pauses) and never test a password or a vulnerability, but some fragile devices still misbehave when contacted on ports they don't expect.

Before switching either on:

• put fragile devices on the never-touch list: medical and clinical equipment, industrial and building controls (PLCs, BMS, HVAC, access control, alarms), old printers, UPS and PDU cards, cameras, point-of-sale terminals and phone systems, and anything the client asks you not to touch;
• get the client's agreement in writing, and tell them when it will start;
• confirm on the appliance's console, under Approved ranges and never-touch list, that you have reviewed the never-touch list. Until you do, neither runs, and the appliance reports why;
• start with one small range during business hours, with someone at the site reachable.

If something misbehaves, add the device to the never-touch list on the console (the firewall blocks it as soon as you save), or choose Shut down to stop everything at once. Then tell us at support@graften.io with the device's make and model.

In the portal

Each appliance shows Reporting, Not reporting (nothing for over two hours), Never reported or Revoked, with its version, waiting operating system security updates (or "not reported"), and a Could not collect list naming each device or collector that failed and why.

Revoke stops the appliance sending anything more. What it already sent stays as evidence.

How results are used

Results feed the compliance controls they're mapped to, always as partial coverage. They never overwrite a verdict you or another automation recorded. Backup and hypervisor results join BC/DR and the Patch Dashboard as one more source.

Updates

• Debian and Microsoft security updates install daily; a restart they need waits for the maintenance window.
• The appliance installs only releases signed with Graften's release key, which is kept offline. It never downgrades and never retries a release that already failed on it.
• If a new release hasn't sent results within 15 minutes, the appliance goes back to the previous one and reports the failure.
• Nothing installs or restarts outside the maintenance window, critical releases included.

Under Site appliances, Account update window sets the default for every appliance, and Update window on one appliance overrides it:

• install releases automatically in the window, or wait for your approval (Approve on the appliance);
• the window: days, start time, 1 to 12 hours, and a time zone;
• the critical limit, 1 to 30 days (default 14): a critical release available for longer installs at the next window, even under approval or a hold;
• hold all updates for up to 90 days.

Network

Outbound, the appliance reaches the approved ranges and Graften's API over HTTPS. Inbound, it accepts nothing except replies, DHCP, ping and syslog (port 514) from the approved ranges. Collector settings come over the same outbound connection: the appliance asks Graften for them, and Graften never connects to it.