Skip to content
Eon Insights

Eon Insights

What is Eon Insights?

Eon Insights is a passive and active network security monitoring platform. A set of collector daemons capture TLS, QUIC, SSH, IKE/IPsec, and OpenVPN handshakes from live interfaces or PCAP files and extract metadata — negotiated protocol version, cipher suite, JA3/JA3S/JA4 fingerprints, certificate details — without decrypting the traffic itself. That metadata lands in ClickHouse, where it’s queried by a REST API and a web dashboard to answer questions like “which hosts still speak TLS 1.0?” or “which certificates expire this month?”

Beyond passive capture, Eon Insights actively scans discovered hosts: tlsscand re-probes each host’s TLS configuration, nmapscand fingerprints open ports and services, and an SCA (Software Composition Analysis) subsystem scans connected Git repositories for vulnerable dependencies. A compliance engine maps findings from the collected data to controls of PCI DSS, NIST SP 800-52, GDPR, HIPAA, NIS2, and DORA, and a notification daemon alerts on expiring certificates and known-malicious TLS fingerprints.

Key properties

  • Passive capture, no decryption. capture reads TLS/QUIC ClientHello and ServerHello messages, SSH key exchange banners, IKE/IPsec SA proposals, and OpenVPN handshakes off the wire (or from a PCAP file) and extracts metadata only — no private keys are needed and no payload is decrypted.
  • Fingerprinting. JA3, JA3S, and JA4 client/server fingerprints are computed for every TLS handshake and checked against a database of known browser, tool, and malware fingerprints (fingerprintd).
  • Active scanning. tlsscand and nmapscand are queue-backed worker daemons that scan hosts discovered through capture (or queued via the API) for supported TLS versions/ciphers and open ports/services.
  • Software Composition Analysis. The sca CLI and scascand daemon scan Maven, npm, Go, and Cargo manifests in Git repositories for known vulnerable dependencies.
  • Compliance reporting. Findings from captured traffic and certificates are mapped to controls of PCI DSS v4.0, NIST SP 800-52 Rev 2, GDPR Article 32, HIPAA, NIS2, and DORA, and can be queried through the dashboard or the /api/compliance endpoints.
  • ClickHouse-backed. All traffic metadata, scan results, certificates, and compliance rules are stored in ClickHouse.

Explore the docs

  • Getting Started — install, set up the database, run your first capture and scan, and view the results
  • Tools — every CLI tool and daemon: purpose, flags, and examples
  • Dashboard — what the web dashboard shows and how to run it
  • Compliance — the frameworks, finding types, and how to manage rules