The LEM is meant to be an appliance, and is running a hardened OS already. Updates for the LEM software are available from the Solarwinds Customer Portal, but regular end-customers have access to the LEM only via the web/AIR GUI and the CMC shell, which is restricted and hardened. Other than that, it's meant to be very hands-off.
PCI Compliance - Gain Your Customers' Trust with Secure Data Systems