Linux Attack Surface Analyzer
LASA documentation
Understand what is exposed on your Linux systems. Install LASA, run your first scan, and turn local runtime evidence into actionable security findings.
Linux AMD64 & ARM64 Read-only collection Local reports. No telemetry.
Find your way
Everything you need to install, use and operate LASA, with clear explanations of the evidence it collects.
-
Install and get started
Set up LASA with APT, Linux Homebrew or a release binary, and check your system's visibility.
-
Run a scan
Explore commands, scanning options, report formats and exit codes.
-
Understand your findings
Follow the evidence behind each result, assess severity and identify your next steps.
-
Know what LASA accesses
See what the scanner reads, what it stores and how your data stays on your systems.
-
Deploy and operate
Schedule scans, manage report retention and configure the optional systemd service.
-
Resolve a problem
Understand permission errors, missing evidence and collection diagnostics.
Your first scan
1. Check your system
After installing LASA, check platform support and the visibility available to your current user.
lasa doctor
2. Collect a snapshot
Run a bounded, read-only scan. The terminal report explains findings and highlights any collection gaps.
lasa scan
3. Save and explore the evidence
Save a JSON report and turn it into a self-contained HTML report for review. Report files stay on your system.
lasa scan --format json --output first.report.json
lasa report --input first.report.json --format html --output first.report.html
Understand the scope
LASA connects process, socket, namespace, mount, permission and selected kernel metadata to security findings. Each result explains what was observed and where visibility was limited. It does not exploit the host, modify its security configuration, capture network payloads or upload reports.
- Product guide — capabilities and common workflows.
- Compatibility and limits — supported systems and collection boundaries.
- Collection, access and privacy — inspected paths, stored data and permissions.
- SecureObs and local exports — working with reports outside the scanner.
Versions and compatibility
Run lasa version to check the installed scanner version. Executable versions and report schema versions are separate; see understand results when comparing reports across releases and compatibility and limits for system requirements.