akash-billawa/execution-aware-scanner

Purpose and Entry Points

This Rust workspace implements an execution-aware vulnerability scanner: it joins image/SBOM CVEs with observed Linux runtime behavior, EPSS/CISA KEV intelligence, risk scoring, attack-path analysis, and optional enforcement. The primary daemon entry point is scanner-agent/src/main.rs; a separate aggregation process exists at scanner-aggregator/src/main.rs. Shared domain types live in scanner-common/src/lib.rs.

Runtime Capture Boundary

Linux eBPF programs emit unified security events for process, file/library, network, probe, and tracing activity. Kernel-side sources are in scanner-ebpf/src/lib.rs, scanner-ebpf/src/events.rs, and scanner-ebpf/src/tracepoints.rs. The agent conditionally loads these programs through scanner-agent/src/bpf_loader.rs; non-eBPF development uses scanner-agent/src/bpf_loader_stub.rs. This is the principal platform boundary: eBPF needs Linux kernel 5.8+, BTF, compatible headers, and privileged capabilities.

Event Ingestion and Runtime Evidence

The agent consumes kernel events, converts them into its userspace runtime model, and records execution evidence such as loaded libraries and network activity. The pipeline centers on scanner-agent/src/event_consumer.rs, scanner-agent/src/runtime_mapper.rs, and scanner-agent/src/runtime_correlation.rs. scanner-agent/src/state.rs is the in-process state boundary used by downstream analysis; runtime evidence determines whether an otherwise static vulnerable component is reachable.

Vulnerability and Intelligence Pipeline

Static software inventory and vulnerability detection originate from image/SBOM inputs and OCI scanning, represented by scanner-agent/src/sbom.rs, scanner-agent/src/oci_scanner.rs, and scanner-agent/src/vuln_detector.rs. Threat intelligence enrichment is handled in scanner-agent/src/intel.rs. The resulting vulnerability records are matched against runtime evidence before prioritization, rather than treating all image CVEs as equally actionable.

Risk, Graph, and Proof Analysis

Risk evaluation combines CVSS, EPSS, KEV, and runtime reachability using scanner-agent/src/risk_engine.rs and scanner-agent/src/predictive_risk.rs. Attack-path construction and runtime-oriented correlation are represented by scanner-agent/src/attack_graph.rs, scanner-agent/src/runtime_attack_graph.rs, and scanner-agent/src/execution_proof.rs. This layer converts enriched findings into prioritized, explainable paths and execution-aware findings.

Policy and Enforcement Boundary

Policy evaluation is separated from enforcement mechanics: scanner-agent/src/policy_engine.rs evaluates policy, including Rego assets under policies/, while scanner-agent/src/enforcement.rs and scanner-agent/src/safe_enforcement.rs apply guarded actions. Network-level controls use scanner-agent/src/tc_enforcer.rs; remediation integration is defined by scanner-agent/proto/remediator.proto and scanner-agent/src/remediator.rs. Enforcement should remain gated by runtime validation and safe/audit modes.

Interfaces, Observability, and Deployment

The daemon exposes findings, scans, policies, and webhook-facing APIs under scanner-agent/src/api/, with metrics and health endpoints implemented in scanner-agent/src/metrics.rs. Outbound notifications are handled by scanner-agent/src/webhook_sender.rs; cloud integration adapters exist in scanner-agent/src/cloud/. It is deployable as a Kubernetes node-level DaemonSet via deploy/kubernetes/daemonset.yaml or the Helm chart at helm/execution-aware-scanner/; RBAC and network isolation are explicit in deploy/kubernetes/rbac.yaml and deploy/kubernetes/networkpolicy.yaml. Grafana dashboards are provisioned from grafana/.