Frequently Asked Questions

Traditional vulnerability management tools focus on detection and ticket generation. When a critical advisory drops, a scanner flags package versions, files a ticket, and waits for an engineer to review and schedule a maintenance window.

The Exultia daemon (`exultia` / `xul`) evaluates local host state first: it inspects whether the affected package is installed, checks whether listening sockets are bound to the vulnerable service, and applies verified Tier 1 configuration guards, kernel sysctl overrides, or open-source `CONFIG_LIVEPATCH` / eBPF CO-RE mitigations without dropping active connections.

Instead of waking engineers up for manual triage on every disclosure, the daemon neutralizes immediate exposure and records a SHA-256 pre-image snapshot and audit log entry.

Vulnerability dashboards frequently flag thousands of low-context findings based solely on package version strings, forcing engineers to spend hours documenting why an unexposed library does not constitute an emergency.

The Exultia daemon correlates advisories against installed packages, active listening sockets, and SOX 404 / PCI-DSS v4.0 configuration baselines. When a genuine exposure or configuration drift is detected, it applies the appropriate mitigation and records a cryptographic receipt in its local SQLite state ledger.

Operations teams retain full control over maintenance windows and rollback checkpoints while reducing manual ticket volume.

Upgrading core packages on disk (such as OpenSSH, NGINX, or database engines) during peak production hours can restart services or require host reboots.

Exultia separates remediation into two distinct tiers: Tier 1 mitigations apply non-destructive drop-in configuration files (such as `/etc/ssh/sshd_config.d/`), runtime `sysctl` settings, firewall blocklists, or open-source Linux kernel livepatches (`kpatch` / `klp` and eBPF CO-RE guards) without modifying package-managed binaries on disk.

Tier 2 vendor package updates (`apt-get`, `dnf`, `zypper`, `apk`, `pacman`) are executed either on demand or during your configured maintenance window (`exultia schedule`), ensuring zero conflict with your distribution's package database.

You can evaluate and verify every component of the platform directly without talking to sales:

1. Step-by-Step Quick Start & Testing Guide (`/wiki?article=quick-start`): Follow the 7-phase local verification guide in the Technical Wiki to test one-line installation, `xul test` self-diagnostics, non-reboot CVE mitigations, `<50ms` SHA-256 rollbacks, SOX/PCI drift reconciliation, and Neural Self-Healing `<PATH_1>` privacy redaction on your own Linux or Windows Server VM.

2. Live Intelligence & Patch Feeds: Browse the live Vantage Threat Intelligence Feed (`/app/uvi`) and the Argent OS & Database Patch Feed (`/argent`) directly in the web console, or query their JSON/STIX REST endpoints.

3. Dry-Run & Profile Config Builder: Set `Remediation Execution Mode` to `Dry-Run Audit Only` in your profile's Daemon Configuration Builder (`/account?tab=config`) or run `exultia sync --dry-run` / `exultia drift --json` to inspect every proposed action before a single file or package is modified.

4. Deterministic Pre-Image Snapshots: Every remediation action records the original file content and SHA-256 digest in `/var/lib/exultia/state.db`, allowing immediate verification and one-command rollback (`exultia rollback --id <UVI-ID>`).

Exultia never performs unsafe, arbitrary byte overwrites in running user-space process heap or stack memory. Instead, non-reboot remediation relies on documented, auditable OS mechanisms:

1. Upstream Linux Kernel Livepatching (`CONFIG_LIVEPATCH`): For kernel CVEs, `exultia livepatch` uses the kernel's native `/sys/kernel/livepatch` ftrace redirection infrastructure (`kpatch` / `klp_patch`), which switches execution at safe function boundaries.

2. eBPF CO-RE Security Guards: When a kernel CVE requires input filtering or syscall parameter validation, the daemon attaches a verifier-checked eBPF CO-RE (`fentry` / `lsm`) program via `bpftool` that can be detached atomically at any time.

3. Atomic Drop-In Configuration & Pre-Image Backups: For user-space daemons, Tier 1 mitigations write validated drop-in configurations and store a full SHA-256 pre-image backup in `state.db` prior to reloading the service.

Exultia is organized into clear, focused components that share a unified data model and subscription:

1. Vantage Threat Intelligence Feed (`/app/uvi`): Aggregates actively exploited vulnerabilities (CISA KEV, zero-days, GHSA, Exploit-DB, Packet Storm) and daily consolidated network/phishing/compromised-host IOC digests (IPSum, OpenPhish, and Emerging Threats Compromised Hosts) under unified `UVI-*` identifiers.

2. Argent OS & Database Patch Feed (`/argent`): Dedicated to pure patch management—normalizing routine vendor security advisories and errata across major Linux/BSD distributions, Windows Server 2019/2022/2025, and 8 database engines without mixing in threat-actor IOC feeds.

3. Exultia Unified Daemon (`exultia` / `xul` / `exultia.exe`): The portable host remediation agent that ingests Vantage and Argent feeds, applies Tier 1 mitigations and open-source kernel livepatches, orchestrates Tier 2 vendor package upgrades, enforces SOX/PCI drift controls, and generates CycloneDX 1.6 CBOMs.

4. Supporting Platform Tools: Praxis (`/app/praxis`) compiles zero-dependency POSIX `/bin/sh` scripts and hardware firewall ACLs; Daedelus (`/products/daedelus`) provides air-gapped developer workstations and distroless container specifications; and Axiom (`/app/axiom`) delivers cybersecurity certification preparation and institutional LMS assessment APIs.

Production environments run heterogeneous fleets across bare metal, virtual machines, and cloud instances. Requiring organizations to re-image servers onto a custom OS distribution introduces significant operational friction.

By delivering Exultia as a portable daemon (`exultia` / `xul`), any existing host can be enrolled immediately:

• Zero OS Re-Imaging: Runs directly alongside your existing Linux distribution, kernel, package manager, and init system (`systemd` or `cron`).

• Broad Distribution Coverage: Supports Debian, Ubuntu, RHEL, Rocky, AlmaLinux, CentOS Stream, Fedora, SUSE/SLES, Alpine, Arch, Amazon Linux, Oracle Linux, and POSIX UNIX environments.

• Offline & Air-Gap Ready: Operates with a local SQLite state database (`state.db`) and supports local offline feed bundles.

Every remediation cycle follows a deterministic five-stage workflow:

1. Ingest: The daemon retrieves advisory records from the Vantage and Argent feeds (or a local air-gapped bundle) and expands any daily grouped IPSum, OpenPhish, or Emerging Threats Compromised Host indicator digests.

2. Correlate & Filter: Checks whether the advisory is currently deferred (`deferrals` table in `state.db`) and whether the affected package or service is present on the host.

3. Snapshot Pre-Image: Before modifying any configuration file or applying a mitigation, the daemon records the target file's path, content, and SHA-256 digest in `state.db`.

4. Remediate: Applies the Tier 1 configuration/livepatch mitigation or Tier 2 vendor package upgrade.

5. Verify & Audit: Confirms command completion, updates the local SQLite ledger, and exposes the updated state via CLI and webhook status endpoints.

You can validate the compliance drift and rollback engine on any test host in seconds (see Phase 4 of the Quick Start & Local Testing Guide at `/wiki?article=quick-start`):

1. Audit Current Controls: Run `sudo exultia drift --json` (or `sudo xul --drift --json`) to inspect all 17 SOX 404 and PCI-DSS v4.0 configuration rules and their current compliance status.

2. Remediate Drift: Run `sudo exultia drift --fix` to automatically back up non-compliant configuration files (computing their SHA-256 pre-image hash) and apply the hardened baseline settings.

3. Verify Audit Trail: Inspect `/var/lib/exultia/state.db` or run `sudo exultia status` to view the recorded pre-image snapshot and drift remediation history.

While the `exultia` daemon targets modern Linux distributions, many enterprise environments also operate legacy UNIX systems (IBM AIX, Oracle Solaris, HP-UX, FreeBSD/OpenBSD) and hardware perimeter routers where modern runtimes or eBPF are unavailable.

Praxis (`/app/praxis`) is a deterministic remediation compiler for these targets:

• Pure POSIX.1-2008 Shell Synthesis: Generates self-contained `/bin/sh` remediation and rollback scripts with SHA-256 pre-image backups that run on legacy Bourne and Korn shells without external dependencies.

• Hardware Firewall ACL Compiler: Translates active threat intelligence and CVE exploit vectors into native access control lists for Cisco IOS, Palo Alto PAN-OS EDL, Fortinet FortiGate, and Juniper SRX.

• Compliance Drift Scripts: Produces standalone audit and remediation scripts for SOX 404 and PCI-DSS v4.0 host controls.

Yes. For air-gapped, classified, or restricted-network environments, Exultia supports completely offline operation:

• Local SQLite State & Catalog: The daemon stores applied patches, deferrals, configuration pre-images, and synced advisory records in `/var/lib/exultia/state.db`.

• Offline Release Bundle (`exultia-vantage-universal.tar.gz`): Ships with the compiled native binary (`bin/exultia`), installer (`install.sh`), configuration template (`exultia.conf`), service definitions (`services/*`), and pre-seeded offline data (`data/uvi_catalog.db` and `data/threat_ips.table`).

• Profile Download Pointer: You can download the standalone Vantage SQLite Catalog (`.db`), daemon binaries, and your customized `exultia.conf` directly from the `Offline Catalog Downloads & Product Consoles` section of your profile (`/account?tab=config`).

Yes. Exultia is designed to drop cleanly onto existing Linux server fleets across cloud, on-premises, and edge environments:

• Unified CLI (`exultia` / `xul`): Provides subcommands and flags for `sync`, `patch`, `livepatch`, `drift`, `rollback`, `defer`, `schedule`, `cbom`, `webhook`, and `status`.

• Native Service Integration: Configures native `systemd` timers (`exultia-remediate.service` and `exultia-remediate.timer`) or `/etc/cron.d/exultia-remediate` schedules.

• Zero Infrastructure Disruption: Audits configuration drift, correlates advisories, and stages updates on your existing Linux servers without reformatting or changing distributions.

Exultia supports both standalone Linux hosts and containerized cluster nodes:

• Standalone Linux Hosts & VMs:

- Installer: `curl -sSL https://exultia.tech/install.sh | sudo sh` installs `/usr/local/bin/exultia` (`0700` `root:root`) and creates the `/usr/local/bin/xul` symlink.

- Configuration: Customize your policy in `/account?tab=config`, download `exultia.conf`, and place it at `/etc/exultia/exultia.conf` alongside `/etc/exultia/license.key`.

- Scheduling: `sudo exultia schedule --scheduler systemd --window "Sun 02:00-05:00"` registers automated maintenance units.

• Kubernetes Clusters (DaemonSet):

- Deploy as a privileged node DaemonSet (`kubectl apply -f https://exultia.tech/k8s/exultia-daemonset.yaml`) to audit host kernel livepatch status, node compliance drift, and cryptographic inventory across cluster worker nodes.

Exultia uses a single unified 2-tier pricing model covering every product in the platform (Vantage, Argent, the Exultia daemon, Praxis, Daedelus, and Axiom):

1. Community Edition ($0 forever): Designed for individual developers, researchers, and homelabs. Includes the local self-healing daemon, public Vantage and Argent feeds, Praxis POSIX script generator, and unlimited in-browser Axiom exam practice.

2. Enterprise Edition: Designed for production server fleets, compliance environments, and institutional teams. Includes full fleet orchestration, webhook automation, SOX/PCI compliance drift reporting, Daedelus enterprise enclaves, and Unlimited Use of Axiom (including CSV/JSON/HTML certificate exports and the Institutional LMS SCORM/LTI 1.3 API).

Enterprise Fleet Pricing Structure:

• Under 25 Hosts: $25 / node / month billed monthly ($20 / node / month billed annually)

• 25-Host Flat Cap: $500 / month billed annually ($6,000/yr) or $600 / month billed monthly covering up to 25 hosts

• 26 to 100 Hosts: Base 25-host cap + $15 / additional node / month monthly ($12 / node / month billed annually)

• Over 100 Hosts (Enterprise+): Custom volume allocation with our Standard Master Services Agreement (MSA).

• Beta & Promo Access Codes: Approved beta evaluators can enter their Beta Access Code directly on `/checkout` to apply a 100% discount and activate Enterprise Edition immediately without payment.

No. Exultia does not gate documentation, binaries, or pricing behind mandatory sales calls.

You can follow the Quick Start & Local Testing Guide in the Technical Wiki (`/wiki?article=quick-start`), test the Community Edition for free, and use the interactive fleet calculator on the Subscription page (`/account/subscription`) or redeem a Beta Access Code on `/checkout` to provision an Enterprise plan immediately.

For organizations deploying across more than 100 hosts, our Enterprise+ tier provides a downloadable Standard Master Services Agreement (MSA) and invoice billing without lengthy procurement delays.

Yes. Managed Security Service Providers (MSSPs), enterprise SOC teams, and educational institutions can integrate Exultia directly into existing portals and automation pipelines:

• Threat & Patch Feed APIs: Ingest normalized JSON and STIX 2.1 advisories from `/api/threat-feed` and `/api/argent/feed`.

• Remote Daemon Orchestration: Trigger syncs, manage deferrals, and collect CycloneDX 1.6 CBOMs across managed hosts via the daemon's webhook API.

• Institutional LMS Embedding: Embed Axiom certification assessments directly into Canvas, Blackboard, or Moodle using the Enterprise LTI 1.3 and SCORM APIs.