First run
Walk through collector install, permissions, and your first baseline-aligned snapshot.
BLACKGLASS compares live Linux state to approved baselines — highlighting drift that commonly precedes incidents: listeners, privileged users, persistence, SSH posture, firewall regressions, and package/kernel drift.