Compliance

Overview

Eon Insights maps findings from captured traffic and certificate data to controls of a set of compliance frameworks, each with its own rule set. A default rule set ships with the product; rules are editable afterwards through the dashboard or the /api/compliance/rules API.

The results show where your traffic and certificates deviate from each framework’s cryptographic requirements. They are not a certification or an audit opinion.

Frameworks

Six frameworks ship by default:

Framework	Display name
`PCI-DSS`	PCI DSS v4.0
`NIST SP 800-52`	NIST SP 800-52 Rev 2
`GDPR`	GDPR Article 32
`HIPAA`	HIPAA Security Rule
`NIS2`	NIS2 Directive
`DORA`	Digital Operational Resilience Act (EU financial sector)

Each framework gets a score from 0 to 100, based on the rules that trigger for it. The score maps to one of three statuses: compliant, partial, or non-compliant.

Finding types

Rules are built from these finding types:

Finding type	Checks for
`deprecated_tls`	TLS versions below 1.2 (or below 1.1, depending on the framework) in use
`weak_cipher`	Cipher suites classified `insecure` or `weak`
`non_aead`	Non-AEAD cipher modes (CBC) instead of GCM/CCM/ChaCha20-Poly1305
`quantum_vulnerable`	Key exchange using RSA, ECDHE, or DHE (not post-quantum/hybrid)
`small_key`	Certificates with RSA keys under 2048 bits
`self_signed`	Self-signed certificates
`expiring_cert`	Certificates expiring within 30 days
`expired_cert`	Certificates already expired
`sha1_cert`	Certificates signed with SHA-1
`weak_ssh`	SSH connections with weak key exchange, cipher, or MAC algorithms
`weak_ipsec`	IPsec connections with weak encryption, PRF, integrity, or DH group

Each rule carries a finding type, a severity (critical/high/medium/ low), a requirement (a citation into the framework, e.g. “Article 9.2” or “164.312(e)(1)”), and the recommendation text shown in a finding.

Reports

GET /api/compliance/stats returns the score, status, and findings per framework over a rolling 30-day window by default, with the number of affected hosts, certificates, or connections per finding. It also reports post-quantum cryptography (PQC) readiness: how much of your traffic still uses quantum-vulnerable key exchange, which hosts are affected, and which hosts already use PQC/hybrid key exchange.

GET /api/compliance/findings/{type} returns the individual connection or certificate records behind a given finding type, for drill-down from the dashboard’s summary view.

Managing rules

The dashboard’s Compliance Rules page (and the underlying /api/compliance/frameworks and /api/compliance/rules endpoints) let you view, create, edit, and delete individual rules and see which framework(s) they belong to. Changes take effect immediately.

To reset the rule set back to the shipped defaults (adding new rules and updating existing ones by name, without touching custom-created rules):

POST /api/compliance/reload?from_yaml=true

Without from_yaml=true, the same endpoint reloads the frameworks and rules from the database.

Dashboard