Skip to content

Tools

Overview

Eon Insights is a monorepo of Go binaries, one per cmd/<name> directory. Each has a Makefile target (make <name>) that builds it for linux/arm64, linux/amd64, and darwin/arm64 into bin/<os>/<arch>/<name>. Run go run cmd/<name>/<name>.go ... during development, or the built binary in production — except for capture and scascand, which are multi-file package main directories built via go run ./cmd/<name> ... (no single <name>.go entry point); see their respective pages.

Most daemons follow the same conventions: a -c <file> flag pointing at a YAML config file, a -debug flag for verbose zerolog output, and a ClickHouse connection block (host/port/database/username/password) in that config. Daemons that consume a task queue (tlsscand, nmapscand, notifyd, pcapworker, scascand) connect to Redis via asynq and shut down gracefully on SIGINT/SIGTERM.

ToolTypePurpose
insightsHTTP APIMain REST API the dashboard talks to
captureDaemon/CLIPassive capture of TLS, QUIC, SSH, IKE/IPsec, OpenVPN
hostsyncDaemonDiscovers hosts/clients from captured traffic, enqueues scans
tlsscandWorker daemonProcesses queued TLS scan tasks
nmapscandWorker daemonProcesses queued nmap port/service scan tasks
tlsscanCLIOne-shot TLS/SSL scan of a single endpoint
tlslabTest serverTLS protocol simulator for testing capture/scan tools
datagenCLIGenerates synthetic hosts/clients/handshakes for development
ja3importCLIImports JA3 fingerprint databases (Trisul, SSLBL, browsers)
fingerprintdHTTP APICentralized TLS fingerprint database service
pcapworkerWorker daemonExtracts TLS handshakes from uploaded PCAP files
notifydWorker + schedulerCertificate-expiry and malware-fingerprint alerts (email/Slack/webhook)
scaCLIOne-shot Software Composition Analysis scan of a repository
scascandWorker daemonProcesses queued SCA repository scans
devctlDev tool (TUI)Starts/stops/monitors all of the above during local development