Tools
Tools
Overview
Eon Insights consists of a set of command-line tools and daemons, each shipped as a single binary.
Most daemons follow the same conventions: a -c <file> flag pointing at a
YAML config file, a -debug flag for verbose logging, and a
ClickHouse connection block (host/port/database/username/password)
in that config. Daemons that consume a task queue (tlsscand, nmapscand,
notifyd, pcapworker, scascand) connect to Redis and shut down
gracefully on SIGINT/SIGTERM. Redis must have AUTH enabled.
| Tool | Type | Purpose |
|---|---|---|
| insights | HTTP API | Main REST API the dashboard talks to |
| capture | Daemon/CLI | Passive capture of TLS, QUIC, SSH, IKE/IPsec, OpenVPN |
| hostsync | Daemon | Discovers hosts/clients from captured traffic, enqueues scans |
| tlsscand | Worker daemon | Processes queued TLS scan tasks |
| nmapscand | Worker daemon | Processes queued nmap port/service scan tasks |
| tlsscan | CLI | One-shot TLS/SSL scan of a single endpoint |
| fingerprintd | HTTP API | Centralized TLS fingerprint database service |
| pcapworker | Worker daemon | Extracts TLS handshakes from uploaded PCAP files |
| notifyd | Worker + scheduler | Certificate-expiry and malware-fingerprint alerts (email/Slack/webhook) |
| sca | CLI | One-shot Software Composition Analysis scan of a repository |
| scascand | Worker daemon | Processes queued SCA repository scans |