Skip to content
Eon Insights
Getting Started

Getting Started

Overview

This page walks through installing Eon Insights, initializing the ClickHouse schema, running a capture and a scan, and viewing the results in the dashboard. It assumes a Linux host with Docker available.

Prerequisites

  • ClickHouse (traffic metadata, scan results, certificates, compliance rules)
  • Redis with AUTH enabled (task queue for the tlsscand/nmapscand/ notifyd daemons, and service heartbeats)
  • libpcap for the capture tool’s live capture on macOS/BSD (Linux uses raw sockets)

Install the tools

Each Eon Insights tool ships as a single binary. Install the binaries for your platform from the release and put them on your PATH.

Set up the database

Start ClickHouse:

docker run -d --name insights-clickhouse \
  -p 19000:9000 -p 18123:8123 \
  clickhouse/clickhouse-server

Then initialize the schema with the schema installer included in the release, pointing it at the schema index file from the same release:

dbmigrate -e clickhouse -h localhost -p 19000 -U default \
  -db insights -path <schema-index.lst> -W

-W prompts for the password interactively.

Start Redis as well, since the scan/notification daemons depend on it. Always set a password:

docker run --name insights-redis -d -p 6379:6379 redis \
  redis-server --requirepass <redis-password>

Configure and run the API server

insights is the REST API the dashboard talks to. Copy and edit the insights.yaml template (ClickHouse connection, listen address, identity provider settings for login), then run it:

insights -c /etc/insights.yaml

See insights for the full flag reference.

Run your first capture

Run capture against a live interface (requires root/raw-socket privileges) or an existing PCAP file:

# Live TLS capture (needs sudo on most systems)
sudo capture tls -i eth0 -host localhost -port 19000 -db insights

# Or replay a PCAP file — no privileges required
capture tls -r /path/to/capture.pcap -host localhost -port 19000 -db insights

See capture for the other protocols (quic, ssh, ike, vpn, all) and their flags.

Run your first scan

Once hosts start showing up from capture, start hostsync to discover them and enqueue scan tasks, and tlsscand/nmapscand to process the queue:

hostsync -c hostsync.yaml -once
tlsscand -c tlsscand.yaml
nmapscand -c nmapscand.yaml

Or scan a single endpoint directly from the command line without going through the queue at all:

tlsscan https://example.com

View it in the dashboard

Serve the dashboard and reverse-proxy /api, /auth, and /oauth to insights (see Dashboard). Open it in a browser and log in with an account from the identity provider configured in insights.yaml.

Dashboard