How cpouthier/malware-scan works
Kasten Malware Scan provides a browser-driven and scheduled workflow to validate and scan exported restore points, with an independent Trivy image-vulnerability check. The main app coordinates Kasten operations and ephemeral scanner pods, then records results and streams progress to the browser. Supporting capabilities include persistent scan history, recurring schedules, rules/signature updates, custom YARA rules, registry credentials, email alerts, and licensing. Edges reflect the shown imports and calls or explicit README workflow statements; some implementation details are unsampled, so uncertain connections are omitted.
Main entry points: main.py API and WebSockets · orchestrator.py Scan orchestration · alerting.py Email alerting · k10.py Kasten operations
Components 20
App interface
- Web UI
app/static/index.html - API and WebSockets
app/main.py
Scan workflow
- Scan orchestration
app/orchestrator.py - Malware scanner
scanner/scan.py - Image vulnerability scan
scanner/scan.py
Rules and data
- Rules management
app/rules_cache.py - Signature updater
app/update_rules.py - Cache seeding
app/seed_cache.py - Custom YARA rules
app/custom_rules.py - Shared cache PVC
Operations
- Recurring schedules
app/scheduler.py - Scan history
app/orchestrator.py - App settings
app/settings.py - Registry credentials
app/registries.py - Email alerting
app/alerting.py - License verification
app/license.py
Cluster integrations
- Kasten operations
app/k10.py - Kubernetes cluster
- SMTP service
Other components
- Operator
Connections 26
- Operator → Web UI: uses
README.md - Web UI → API and WebSockets: requests
README.md - API and WebSockets → Scan orchestration: starts scans
app/main.py - API and WebSockets → Recurring schedules: manages schedules
app/main.py - API and WebSockets → Rules management: manages rules
app/main.py - API and WebSockets → Custom YARA rules: manages rules
app/main.py - API and WebSockets → App settings: manages settings
app/main.py - API and WebSockets → Registry credentials: manages credentials
app/main.py - API and WebSockets → License verification: checks license
app/main.py - Scan orchestration → Kasten operations: drives Kasten
app/orchestrator.py - Scan orchestration → Malware scanner: runs malware scan
README.md - Scan orchestration → Image vulnerability scan: runs image scan
README.md - Scan orchestration → Scan history: persists results
app/orchestrator.py - Recurring schedules → Scan orchestration: triggers scans
app/scheduler.py - Recurring schedules → Kasten operations: selects restore points
app/scheduler.py - Rules management → Signature updater: starts updates
app/rules_cache.py - Signature updater → Shared cache PVC: updates cache
README.md - Cache seeding → Shared cache PVC: seeds cache
README.md - Custom YARA rules → Shared cache PVC: stores custom rules
app/custom_rules.py - Malware scanner → Shared cache PVC: uses rules cache
README.md - Image vulnerability scan → Registry credentials: uses credentials
- Email alerting → App settings: reads alert settings
app/alerting.py - Email alerting → Kasten operations: reads SMTP secret
app/alerting.py - Scan orchestration → Email alerting: sends alerts
app/alerting.py - Kasten operations → Kubernetes cluster: operates resources
README.md - Email alerting → SMTP service: sends email
app/alerting.py