Features

Everything SkausWatch ships with today.

Scan S3-compatible buckets for malware using ClamAV and the pure-Rust yara-x engine.

Every scan runs ClamAV (INSTREAM protocol) and yara-x in parallel against downloaded objects — no C libyara dependency.
Positive or ambiguous findings are enriched with VirusTotal and AlienVault OTX threat-intelligence lookups before results are stored.
Bucket credentials use a hybrid model: assume_role for real AWS buckets (short-lived STS credentials, no stored secret) or envelope-encrypted static credentials for S3-compatible endpoints with no STS support (MinIO, Wasabi).
Findings are hashed (SHA-1/SHA-2) and file-typed by magic bytes so they can be cross-referenced against external threat feeds.

A continuous ASM pipeline: network enumeration, banner grabbing, TLS inspection, and screenshot capture.

masscan-based port/service discovery, banner grabbing for service fingerprinting, and TLS certificate chain/expiry inspection.
Diff-vs-prior scanning surfaces what changed on a target since its last scan.
Headless-chromium screenshot capture gives a visual snapshot of discovered web services.
Shares the same YARA (yara-x) and ClamAV malware-scan code path as S3 scanning, applied to ASM-discovered targets instead of S3 objects.

A Rust endpoint agent reports file, process, and network telemetry to the platform.

Three independent collectors: process enumeration against a suspicious-process set, file-integrity checks against configured watch paths, and connection enumeration against a suspicious-port set.
Deploys as a Kubernetes DaemonSet or a systemd service on bare metal and VMs.
Config-supplied watch paths and detection lists are always additive to the built-in defaults — a deployment can widen detection coverage but never silently narrow it.
Reports batch to the Manager service over an HMAC-authenticated agent surface, with severity levels matched against a validated threat-level enum.

Audit logging, STIX/TAXII threat-intelligence matching, and SIEM log ingest.

Collectors for auditd, syslog, journald, file-based logs, Kubernetes, LXC, and database-sourced events.
A dedicated threat-intel matcher ingests STIX-formatted intelligence over TAXII feeds and correlates it against the collected event stream.
A separate Logs service OCSF-normalizes incoming events and bulk-indexes them into OpenSearch. Dashboards and alerts surface matches for investigation.

Tenant-isolated, OIDC-scoped access control and SPIFFE/SPIRE workload identity.

Every REST endpoint requires a JWT Bearer token with OIDC scopes and a mandatory tenant claim, validated before any scope check.
Roles — Admin, Maintainer, Viewer — are pre-bundled scope sets, not role-name checks.
A nested-trust-domain SPIRE deployment under the spiffe://penguintech.io/<env>/<service> scheme is wired into the Manager, PKI, s3scan, and vault-sync services.
S3 credentials and other sensitive material are encrypted at rest; secrets are never persisted in plaintext.

One Cargo workspace of 12 Rust services — axum REST, tonic gRPC, sqlx/PostgreSQL — deployed via Helm only.

Replaces a Python/Go/Node.js stack and a Celery-based queue with Valkey/Redis Streams consumer groups for reliable, at-least-once job delivery.
Every REST API is versioned under /api/v1/* and publishes a generated OpenAPI 3.x spec via utoipa — never hand-written.
Deployment is Helm → Kubernetes only, in every environment including local development — there is no Docker Compose path in v2.0.
Every Helm chart ships a CiliumNetworkPolicy (default-deny, port-scoped) and a Tetragon TracingPolicy enforcing an allowlist of runtime binaries.

A licensed secrets-management module: envelope encryption, JIT access, and certificate issuance.

AES-256-GCM envelope encryption with a fresh per-secret data-encryption key and a versioned, rotatable master key.
Just-in-time (JIT) access issues time-limited HMAC-signed tokens through an approval workflow; only the token's hash is ever stored.
One-time secrets support atomic, view-once retrieval — a second access attempt returns 410 Gone.
Cloud vault sync to AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, and Kubernetes Secrets, plus X.509/SSH certificate issuance. Requires the skauswatch.vault flag and a matching license entitlement.

A licensed AI code-review module for GitHub and GitLab pull requests.

Reviews pull requests via GitHub or GitLab webhooks using Anthropic Claude, OpenAI, or a self-hosted Ollama model — all three implement the same provider abstraction, so switching is a config change, not a code change.
OSS license-compliance policies flag dependency licenses as allowed, review-required, or blocked.
Per-repo git credentials are envelope-encrypted using the same crypto primitive the Vault module uses.
Requires the skauswatch.codescan flag and a matching license entitlement, enforced independently at both the platform proxy and the Code Scan service itself.