Tristra Community: our first release

Tristra Community, version 0.5.1, is now available. It is the first release of TRISTRA, and it is free to use under the TRISTRA Free Edition Licence version 4.6.

Why we built it

Many security and IT teams already collect a detailed software inventory through osquery and their existing security tooling. Turning that inventory into a trustworthy list of vulnerabilities is harder than it should be, particularly on networks that cannot reach the internet. Findings are often hard to check, and it is not always clear which update actually closes a vulnerability.

We wanted a tool that works from the data teams already hold, shows its working for every finding and runs fully offline.

What it does

Tristra reads the osquery software inventory your tooling already collects, directly from where it is stored or as CSV and JSON exports. It identifies the installed software exactly, decides which CVEs apply using the vendors’ and distributions’ own security data, and checks remediation against what is installed on each host. It never scans, probes or logs in to a host.

The Tristra overview page

  • Evidence for every finding. Each finding shows the advisory, the installed version, the fixed version and how they compare. Matching is exact, never fuzzy. Tristra names a fix only when it is proven to close the CVE, and tells you when it is not.
  • Linux and Windows. Debian, Ubuntu, RHEL, AlmaLinux and Rocky Linux, kernel packages included. Windows 10 and 11 and Windows Server 2016 to 2025 are assessed from Microsoft’s security update data; the application detectors were built and checked on Windows Server 2025.
  • Prioritised findings. Known-exploited vulnerabilities come first, then EPSS, then severity.
  • A remediation plan. Single updates ordered by what each one closes, with due dates for known-exploited vulnerabilities. Mitigations count only after a second person has reviewed them.
  • Clear gaps. If Tristra cannot assess a host or a piece of software, it tells you why.
  • Reporting. Exports as CSV, JSON, a summary PDF and CycloneDX SBOMs, with delivery to SIEM, threat-intelligence and vulnerability-management platforms.
  • Offline by design. It installs from a signed bundle and takes signed feed updates, so it runs on air-gapped networks.

A finding with its evidence

What Community includes

Tristra Community includes up to ten active projects (archived projects don’t count, and there is no host limit), complete assessment, the current remediation plan, basic exports and a PDF summary, manual threat-intelligence imports, and 30-day history views.

Getting started

Tristra runs on Linux (x86_64) with Docker Engine and Docker Compose 2.24 or newer. Windows or macOS with Docker Desktop is suitable for evaluation only. Setup is a browser wizard, and feed updates come either over the internet or from a mirror folder on air-gapped sites.

Downloads are signed. The TRISTRA page explains how to verify them, and you can request a copy there.

Accuracy and known limits

Tristra’s results are deterministic: the same inventory, the same security data and the same recorded review decisions always produce the same findings, and every finding shows the evidence behind it. That does not make them infallible. Results are only as complete as the detectors and the vendor data behind them, and we are continuing to add detectors to widen that coverage.

We would also rather be clear about what this release does not do yet:

  • Some Linux distributions are not assessed, including SUSE, Oracle Linux, Amazon Linux, Fedora and Alpine. macOS and BSD are not supported.
  • Debian 11 is only partly covered, and Red Hat data lists fixed issues only.
  • Software installed outside package managers is not collected.
  • Windows Server 2012 R2 and older are not assessed, and several Windows products are not assessed yet, including .NET Framework, Office, Exchange and SharePoint.
  • Arm64 installs are not supported.
  • Network devices and appliances are not collected by osquery. They are assessed only when supplied in an inventory document that states an exact NVD CPE, and CVEs tied to particular hardware models are not reported.
  • Container images, registries and cloud services are not scanned; Tristra assesses the software inventory the hosts report.

These are not supported today. Some depend on what vendors publish; we plan to address others in future releases.

Feedback

This is our first release, and we would like to hear how it works for you. If you try Tristra Community, please send feedback, questions or problems to support@pikeandquill.co.uk.