Skip to content
Eon Kartis

Eon Kartis

What is Eon Kartis?

Eon Kartis discovers and scans the cryptographic surface an organization exposes to the internet. Given a domain, it finds related subdomains and same-organization domains (WHOIS, Certificate Transparency logs, DNS reconnaissance, ASN expansion, and technology fingerprinting), resolves them to live hosts, and scans each one for the protocols it speaks: TLS, SSH, STARTTLS-wrapped SMTP/IMAP/POP3, OpenVPN, IKE/IPsec, and plaintext services running on ports where encryption would normally be expected. Findings are scored against a post-quantum-cryptography readiness baseline — hybrid key-exchange groups, certificate signature algorithms, and known-weak protocol versions — and can be rendered into a Markdown report with an executive summary, prioritized findings, and PQC guidance.

Kartis has two consumers of the same data. Machines — Eon Center, Eon Aethis, Eon Insights — read it over the bearer-token /v1/... API and render it in their own dashboards. Humans read it in the Kartis portal, a server-rendered surface at /portal/... where a customer logs in and sees their own estate: hosts, certificates, crypto findings, run history and reports. Both resolve to the same tenant boundary; see Portal.

Key properties

  • Two discovery/scan daemons, a subdomain-enumeration worker, and a scheduler. kartis-discovery finds related domains and hands subdomain enumeration to kartis-recon; kartis-scan scans each resolved host and serves both APIs; kartis-scheduler materialises due runs on a monthly or biweekly cadence. They communicate over Redis pub/sub and share a Postgres database as the source of truth.
  • Depth-controlled scanning. Every scan picks a max penetration depth — discover, passive, active, or vuln — and a category filter (discovery, crypto, web, infoleak). There is deliberately no “offensive” tier reachable through the API or the scan chain; attack-shaped probing only exists as a separate, manually-authorized standalone tool.
  • Honest scanning. The scanner identifies itself on every protocol it speaks — HTTP User-Agent, SSH identification string, SMTP EHLO — with an optional contact URL, and performs no evasion.
  • PQC posture detection. Analyzers classify TLS key-exchange groups as classical, hybrid, or post-quantum-only, and flag certificates signed with classical-only algorithms, so a scan answers “is this endpoint ready for harvest-now-decrypt-later” directly.
  • Crypto-posture classification. One engine, three verdicts: shadow (plausibly yours, not in the central register), rogue (looks like yours but isn’t, or a certificate exists for your name that you never ordered), and drift (a registered asset whose crypto deviates from policy). The baseline is either declared (a register uploaded as xlsx/csv) or learned from the estate itself, and every finding records which — so a report can tell “deviates from your policy” apart from “deviates from your own norm”.
  • Customer-facing reporting. kartis-scan report turns a consolidated scan document into a Markdown report (Dutch or English) with an anonymization pass for sharing sample findings safely.
  • Bearer-token HTTP API. Sessions, runs, findings, services, and discovery trees are all reachable over /v1/... endpoints, which is how Eon Center, Eon Aethis, and Eon Insights consume Kartis data.
  • Export and replay. A full-scan export can be replayed back into the schema, so a scan captured elsewhere lands as ordinary rows.

Explore the docs

  • Scanning — the discovery and scan pipeline, the depth/category model, and the CLI and API for running scans
  • Portal — the customer-facing web surface: pages, login, tenancy, domain verification, and the scan schedule
  • Reports — generating and anonymizing Markdown reports from scan results
  • Configuration — config files, profiles, and environment variables for each component