Security Posture in a Box
(XIB)
A unified operational view across vulnerabilities, exploitation priority, compliance, identity, and PKI—without hiding the five tools that produce the evidence.
Security posture rarely fails because a team has no scanner. It fails because vulnerability, threat-intelligence, compliance, identity, and certificate evidence live in separate places. XIB composes five focused In a Box projects and gives them one Grafana entry point while preserving each tool's ownership and boundaries.
⚡ Quick start
git clone --recurse-submodules https://github.com/matijazezelj/xib.git
cd xib
make up
Open the XIB Security Overview at http://localhost:3000.
Keep
--recurse-submodules. XIB pins the component repositories so a deployment is repeatable instead of quietly collecting whatevermainhappens to contain that morning.
The five capabilities
| Project | Question it answers | Core evidence |
|---|---|---|
| VIB | Which running images are vulnerable? | Trivy findings and vulnerability history |
| TIB | Which findings are being exploited or are likely to be? | CISA KEV and EPSS correlation |
| CIB | Which containers violate policy or lifecycle rules? | Runtime policy, SBOM licenses, and OS EOL |
| IIB | Who can authenticate, and is the identity plane healthy? | Authentik identity and login metrics |
| PIB | Which certificates are trusted, expiring, or already broken? | step-ca and endpoint certificate metrics |
What XIB adds
- One deployment workflow for all five pinned projects
- One Grafana entry point with a cross-project security overview
- Five explicit data sources, one for each tool’s VictoriaMetrics instance
- Shared setup and secret generation without flattening every component into one opaque service
- A consistent update path through pinned Git submodules
XIB does not pretend five security domains are one database. Each project retains its own state and remains independently deployable. The unified dashboard is a decision surface, not a rewrite of the underlying tools.
The operating view
The XIB dashboard combines:
- Critical and high vulnerability counts
- CISA KEV matches and exploitation priority
- Container policy, license, and EOL violations
- Identity activity and login failures
- Certificate expiry and validity health
- Last successful synchronization for every collector
The practical outcome is a shorter path from “there are many findings” to “these are the few conditions that deserve action now.”
When to use XIB
- You want the full focused security-posture suite
- One team owns vulnerability, compliance, identity, and certificate operations
- You want a unified view but still need inspectable component boundaries
- You prefer pinned, self-hosted open-source tools over a mandatory SaaS control plane
When to deploy tools separately
- You only need one or two capabilities
- Different teams own the domains and their data
- You already have a preferred Grafana or metrics architecture
- Independent retention, scaling, or access control is more important than one entry point
Five evidence sources. One useful security-posture view.
View XIB on GitHub🚀 Need Help Getting Started?
Self-hosting is free and always will be. But if you'd rather have it deployed, configured, and maintained for you — I can help.