Tier 2 Self-Hosted Deployment
Overview
Deploy the EchelonGraph Tier 2 Runtime Security Agent inside your own infrastructure. The agent scans your network, containers, and Kubernetes clusters — all data stays inside your boundary.
Key capabilities:
- Network scanning (TCP, SSL/TLS, HTTP, DNS, Shadow IT)
- Container image CVE scanning with SBOM generation
- Kubernetes security (CIS benchmarks, RBAC audit, network policies)
- Runtime enrichment (MITRE ATT&CK, PCI DSS v4.0, attack path analysis)
- BYOK encryption — SaaS backend never sees plaintext data
- Air-gapped mode — no outbound network required
What it needs to run
- Kubernetes 1.24+ cluster (or Docker 20.10+)
- Helm 3.10+ for the Kubernetes deployment
- Network access to the target CIDR range(s)
- (Optional) Docker socket access for container scanning
- (Optional) internet access for CVE database updates — not required in air-gapped mode
It runs either as a persistent daemon that re-scans on an interval, or as a CronJob / one-shot scan. Default footprint: top 100 ports, 200 concurrent workers, 1000 packets per second, 2s connect timeout, 10-minute maximum scan window, 15-minute interval in daemon mode — all tunable, with HTTP and SOCKS5 proxy support. It exposes a Prometheus metrics endpoint and a health endpoint.
Network posture
Two outbound destinations, both TCP 443. No inbound rules required.
| Destination | Protocol | Purpose |
|---|---|---|
app.echelongraph.io | HTTPS / REST | Enrollment, heartbeat, scan progress callbacks |
ingest.echelongraph.io | gRPC over TLS | Telemetry stream — the same edge Tier 1 and Tier 3 use |
Enrollment uses a one-time token issued from the dashboard.
Data protection
BYOK encryption. With a 32-byte AES-256-GCM key you supply, telemetry is encrypted before transmission. The SaaS backend stores encrypted blobs and never decrypts them; an unencrypted correlation ID travels alongside so the graph stays traversable. A second rotation key lets new data move to a new key.
Air-gapped mode. Results are written as JSON files to local storage instead of being transmitted, matched against a bundled CVE database.
Licensing. An HMAC-signed license key controls which scanning modules are enabled, the asset cap, expiry, and tier binding; without one the scanner runs in SaaS mode with all features enabled. Keys can be replaced without a restart.
Known limitations
| Failure | Cause |
|---|---|
| "license key expired" | The license passed its expiry; the scanner exits gracefully |
| "HMAC signature verification failed" | The key is corrupted or tampered with — a new one is required |
| "tier X is below minimum required tier 2" | The license is for a lower tier |
- Container scanning needs the Docker socket mounted read-only. On containerd runtimes it falls back to the Kubernetes API, so Kubernetes scanning must be enabled.
- No findings usually means the target CIDR is unreachable from the scanner, or the relevant feature flag is off.
- Kubernetes scanning depends on its ClusterRoleBinding and ServiceAccount permissions.
- The BYOK key must be exactly 64 hex characters (32 bytes); anything else is rejected.
Deploying it
A deployment call covers the Helm or Docker install for your environment, CIDR scoping, BYOK key handling and rotation, and the air-gapped bundle if you need one. Talk to us about deployment