System roles
A role turns an enrolled system into something with a job: it installs and configures the tools the job needs. Assigning a role is a change, so it goes through Approvals: you see the exact commands, approve them, and Garrison checks the result.
Assign a role from Systems: open the system and click Assign role.
| Role | What it sets up | Use it for |
|---|---|---|
| Log collector | Grafana Alloy, sending the system’s logs and metrics to the appliance | Every system you want in Observe and in chat answers about logs |
| Scanner | naabu (open ports) and nuclei (known exposures). nmap only if you ask for it (its licence is not open source) | Running attack-surface scans from inside your network |
| Jump host | Hardened SSH: key-only login, no root login, short login grace, verbose auth logging | A controlled entry point for administrators |
| Threat-hunting console | Tools for working with SIEM exports and logs, and host telemetry: auditd (Linux) or Sysmon (Windows) | An analyst workstation |
Notes:
- Jump host refuses to apply when the system has no SSH keys installed, so nobody is locked out.
- A Scanner only scans targets you have authorized under Attack surface. It never scans anything else.
- The log collector sends only to the appliance. Forwarding the same logs to your SIEM is a separate step: ask Garry to onboard the system to your SIEM.
- Removing a role removes its tag; the installed tools stay in place.