InfoRelay's tool suite for air-gapped admin workstations. Offline DISA Cisco STIG audits and single-binary AD CS cert lifecycle — no telemetry, no installer, no phone-home. Built for the engineers running the perimeter, not their dashboards.
Catalog-driven, intelligence-augmented, audit-trail-ready. Every tool ships as a single binary — no MSI, no service, no registry edits.
DISA Cisco STIG audit · live SSH pull · MANUAL triage · CKL / annotated.cfg / XLSX / PDF.
Live · v0.1L3 routing + EIGRP troubleshooter. See which prefix rides static vs EIGRP, pinpoint why an adjacency won't form (auth-key gap, K-values, MTU), and get make-before-break key rotation + a static→EIGRP migration plan. Reads IOS/NX-OS/ASA/FTD.
Live · v0.1Read the core's flow cache + NBAR offline and split every port & protocol into internal (east-west) vs external-outbound. Fingerprints each host's device family (Windows, AD/DC, SQL, Linux, Cisco) and thumbprints irregular traffic — sensitive services leaving the enclave, cleartext egress, scans. Read-only, never sniffs packets.
Live · v0.1A NetBrain-style diagnostic brain that runs offline, day one. Ask it in plain English — "a host authenticates but gets no IP", "an approved site times out through the FTD", "EIGRP neighbor is down" — and it fires diagnostic agents that chain network Intents (device-tracking, DHCP-snooping/IPSG, 802.1x/ISE, EIGRP auth) and 31 executable runbooks, then ranks the root cause with the exact fix. Deterministic core; optional AI copilot skin. No $40k, no config project.
Live · v0.1Windows AD CS-aware cert tool. Discover · monitor · enroll · bulk CSR · troubleshoot. 11 prebuilt template recipes.
Tenable.sc operator's toolbox. See, find, and fix what the SC dashboard hides — license, scan zones, churn, diagnostics.
DoD Cyber Hygiene Scorecard automation. Import CSVs → preview → fill manual sections → export a paste-ready hardening workbook.
"Can workstation X reach Call Manager Y on tcp/2000?" Walks L2/L3/ACL/routing across every audited device.
Continuous config-drift detection across your inventory. Alerts on baseline divergence — without ever sending configs anywhere.
Automated device config backup with gold-image restore. Satisfies the STIG backup mandate offline — scheduled pull, signed snapshots, one-click revert.
PAN-OS and JunOS STIG audit modules with the same Deviation + Triage intelligence layer.
Live discovery, normalization, and offline change-control for the whole fleet. CMDB-grade artifacts, zero connected services.
The quarterly review is in two weeks and 70% of findings are MANUAL. NetGuard triages them with engineering reasoning — so you file, not flounder.
The admin workstation can't talk to the internet. Cloud tools are not an option. NetGuard never phones home — the binary is the whole deployment.
Anything that installs needs a 6-week Software Approval Baseline review. No MSI, no service, no registry edits — the SHA-256 IS the artifact your ISSO tracks.
NetGuard is in final testing on live DoD-grade fabrics. Public builds return when v1 ships — no half-baked binaries on air-gapped networks.
Need early access for an evaluation? Email licensing@inforelay.ai — we hand-issue evaluation builds to qualified shops.