Create a one-host Patch Truth report.
Copy the command, run it on one supported Linux host, and watch for the upload. Once the snapshot lands, oxharden builds a token-protected report that says whether this host needs a package update, restart/reboot, no action, or a cleaner scan.
Run the snapshot
Generate a command for this report.
This creates a short-lived snapshot ID and token, then this page waits for that exact host upload.
After the command is created, copy it to one supported host. This page will track that same snapshot ID and open the report when processing finishes.
Create the command, run it, then keep this page open.
The progress state mirrors the enrollment flow: upload accepted, packages matched, report written, secure link ready.
Supported hosts
Start with a RHEL-family host.
Snapshot matching is intentionally scoped to distros where the CVE pipeline has vendor advisory coverage. Unsupported hosts should fail clearly instead of producing a false-clean report.
What it collects
Package inventory
Package name, epoch/version/release, architecture, vendor, and install state needed for CVE matching.
Host basics
Redacted host label, distro, distro version, kernel release, and agent version for report context.
Runtime evidence
Signals used to separate package update debt from restart or reboot debt when runtime data is available.
Timing and status
Collector duration, record counts, unsupported distro status, and incomplete evidence flags.
Report preview
Installed EVRs are below the vendor-fixed package versions.