The Right Scanner on Every Endpoint, Driven by Your Ingress
Deploy Samma into any Kubernetes cluster. It picks up your Ingresses and scans them for TLS, security header, port and OWASP-style findings. Connect samma.io to add external scanners and validated compliance scanners, and read every result in your own Grafana.
How Scanning Works
Each endpoint gets the scanners it needs, and you only pay for scans while the endpoint exists.
Follows your Ingresses
Install the open-source operator and annotate an Ingress. Scanners start against every host in it, from inside your cluster.
External scanners from samma.io
Connect the operator to samma.io and your external hosts are shared with the portal. samma.io adds external scanners for an outside-in security baseline.
Compliance scanners per target
Tag an Ingress with pci-dss and samma.io runs a validated vendor scanner, such as a PCI ASV, against that endpoint. Use different vendors for different targets.
Results in your own Grafana
In-cluster, external and vendor findings all come back to Grafana inside your cluster, per target.
Drop the Ingress, drop the scanners
Scanners live as long as the target does. When an endpoint is gone, its scans and their cost are gone too.
Controlled from git
Scanning is set by Ingress annotations, so it is reviewed and versioned with the rest of your manifests.
Open-Source Scanners in Your Cluster
Every scanner runs as an isolated Kubernetes job, once straight away and then on a schedule. Pick them one by one or as a profile such as web, network or detect.
Detect scanners
Lightweight checks that are safe to run often.
TLS
Certificate validity, expiry and days left, issuer, protocol and cipher. Catch expiring certificates and old TLS versions.
HTTP security headers
HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, checked against OWASP secure-headers practice.
HTTP redirects
The full redirect chain, hop by hop. Make sure HTTP goes to HTTPS and nothing redirects somewhere unexpected.
Ports
Which TCP ports are open. Spot services that should never be exposed.
SSH banner
SSH server software and version. Find outdated SSH servers.
DNS
A, AAAA, MX and TXT records. Track DNS changes and dangling records.
WHOIS
Registrar, creation and expiry dates, name servers. Never let a domain lapse.
Traceroute
The network path to a target, and when it changes.
Classic scanners
Deeper, battle-tested tools that actively probe for vulnerabilities.
Nmap
Ports, web recon and TLS ciphers
The industry-standard network mapper, run in three modes: a full port scan, web server fingerprinting with http-enum, and a graded list of every TLS cipher and protocol the server accepts.
- SYN port scan
- Service and web application detection
- TLS cipher and protocol grading
Nikto
OWASP-style web findings
Tests web servers for dangerous files, outdated software and misconfiguration, the issues an attacker sees first.
- Thousands of known-vulnerability checks
- Outdated server software
- Misconfiguration and default files
Tsunami
High-severity vulnerabilities
Google's plugin-based scanner for the critical issues, with a low false-positive rate.
- Remote code execution detection
- Exposed admin interfaces
- Weak credential detection
More Scanners with samma.io
Connect the operator to samma.io with an API token. Your Ingress hosts are shared with the portal, and samma.io adds the scanners your cluster can't run on its own.
External scanners
An outside-in baseline
Attackers see your endpoints from the internet. samma.io scans every shared host from outside your network, so each target gets an external security baseline next to the in-cluster results, with no extra setup per host.
Vendor and compliance scanners
Validated scanners, only where you need them
Compliance work such as PCI DSS needs scans from a validated vendor. Tag the Ingress and samma.io runs the right vendor scanner against that endpoint. Use one vendor for some targets and another for the rest. Vendors are connected on the samma.io side, so you don't need an account with each one.
metadata:
name: checkout
annotations:
samma-io.alpha.kubernetes.io/enable: "true"
samma-io.alpha.kubernetes.io/profile: "web"
samma-io.alpha.kubernetes.io/compliance: "pci-dss"