Documentation
Getting started
What the platform does, how an organisation is set up, and the first things to do after you sign in.
What Holistra does
Holistra is a vulnerability assessment and posture management platform. It brings several kinds of assessment into one place and ranks the results by what attackers actually exploit:
- Scans you launch from the dashboard: network, web application (DAST), OWASP Top 10, PCI-DSS and GDPR checks, CIS benchmarks for Linux and Windows hosts, credentialed host audits, dependency (SCA) and code (SAST) scans of a repository, and cloud configuration (CSPM) for AWS, Azure and GCP.
- Endpoint agents on Linux, macOS and Windows that report the device, its installed software, its security posture and its attack surface, and that can run remediation scripts you dispatch.
- Compliance baselines run through the agents, with a score per host and per organisation.
- Threat intelligence: findings are enriched with the CISA Known Exploited Vulnerabilities catalogue (KEV) and EPSS exploit-probability scores.
Cloud or dedicated instance
The same platform runs two ways:
| Model | Where it runs | Who updates it |
|---|---|---|
| Cloud service | Our hosted service at app.holistrasecurity.com. Your organisation is isolated from every other customer. | We do. |
| Dedicated instance | A single-tenant installation on infrastructure you control, activated with a licence key we issue to you. | Your administrator decides when threat-intelligence and agent updates are installed. |
See On-premises installation for what a dedicated instance needs.
How you get an account
There is no public sign-up. Our team creates your organisation and its first Administrator account. After that, your Administrators add people themselves, or connect your identity provider so that accounts are created on first single sign-on or provisioned over SCIM. See Users, roles and SSO.
Cloud customers sign in at app.holistrasecurity.com/login. A dedicated instance uses the hostname your team gave it.
Your first hour
- Sign in and secure your account. Change the temporary password if you are asked to, then set up two-factor authentication under Settings → Profile.
- Set your organisation's policy. Under Settings → System, choose the session timeout, lockout threshold, password expiry and whether two-factor authentication is required.
- Invite your team under Settings → Users, giving each person the least privileged role that fits: Admin, Security Engineer or Auditor.
- Run a first scan. On Scans, pick a scan type, enter a target you are authorised to test and start it. The Scans page shows its progress, and its results appear under Findings.
- Enrol an agent on one machine from Agents → Enroll, then approve it. Within a few minutes you will see its device page, and its software inventory and posture checks soon after. See Installing agents.
- Review the dashboard. Start with any findings flagged as known-exploited. See Dashboard and alerts.
Only scan what you are authorised to test
All documentation
- Installing agents
- Enrol the endpoint agent on Linux, macOS and Windows, approve it, keep it updated and remove it.
- Dashboard and alerts
- The posture score, findings and their triage, what gets flagged for attention, and reports.
- Users, roles and SSO
- Roles, password and two-factor policy, single sign-on with OpenID Connect, SCIM provisioning and the break-glass account.
- API
- Authenticate against the REST API and call the main endpoints for scans, findings, assets, agents and reports.
- On-premises installation
- What a dedicated, single-tenant instance needs from your environment and what your administrator manages.
- Troubleshooting and FAQ
- Common problems with agents, sign-in, scans and SSO, and answers to frequent questions.