Tier 2 Self-Hosted Deployment
Overview
Deploy the EchelonGraph Tier 2 Runtime Security Agent inside your own infrastructure. The agent scans your network, containers, and Kubernetes clusters from inside your boundary and sends its findings to EchelonGraph (encrypted with your own key if you enable BYOK), unless you run it in air-gapped mode, which keeps results on local storage.
Key capabilities:
- Network scanning (TCP, SSL/TLS, HTTP, DNS, Shadow IT)
- Container image CVE scanning with SBOM generation
- Kubernetes security (CIS benchmarks, RBAC audit, network policies)
- Runtime enrichment (MITRE ATT&CK, PCI DSS v4.0, attack path analysis)
- BYOK encryption — SaaS backend never sees plaintext data
- Air-gapped mode — no outbound network required
What it needs to run
- Kubernetes 1.24+ cluster (or Docker 20.10+)
- Helm 3.10+ for the Kubernetes deployment
- Network access to the target CIDR range(s)
- (Optional) Docker socket access for container scanning
- (Optional) internet access for CVE database updates — not required in air-gapped mode
It runs either as a persistent daemon that re-scans on an interval, or as a CronJob / one-shot scan. Default footprint: top 100 ports, 200 concurrent workers, 1000 packets per second, 2s connect timeout, 10-minute maximum scan window, 15-minute interval in daemon mode — all tunable, with HTTP and SOCKS5 proxy support. It exposes a Prometheus metrics endpoint and a health endpoint.
Network posture
Two outbound destinations, both TCP 443. No inbound rules required.
| Destination | Protocol | Purpose |
|---|---|---|
app.echelongraph.io | HTTPS / REST | Enrollment, heartbeat, scan progress callbacks |
ingest.echelongraph.io | gRPC over TLS | Telemetry stream — the same edge Tier 1 and Tier 3 use |
Enrollment uses a one-time token issued from the dashboard.
Data protection
BYOK encryption. With a 32-byte AES-256-GCM key you supply, telemetry is encrypted before transmission. The SaaS backend stores encrypted blobs and never decrypts them; an unencrypted correlation ID travels alongside so the graph stays traversable. A second rotation key lets new data move to a new key.
Air-gapped mode. Results are written as JSON files to local storage instead of being transmitted, matched against a bundled CVE database.
Licensing. An HMAC-signed license key controls which scanning modules are enabled, the asset cap, expiry, and tier binding; without one the scanner runs in SaaS mode with all features enabled. Keys can be replaced without a restart.
Known limitations
| Failure | Cause |
|---|---|
| "license key expired" | The license passed its expiry; the scanner exits gracefully |
| "HMAC signature verification failed" | The key is corrupted or tampered with — a new one is required |
| "tier X is below minimum required tier 2" | The license is for a lower tier |
- Container scanning needs the Docker socket mounted read-only. On containerd runtimes it falls back to the Kubernetes API, so Kubernetes scanning must be enabled.
- No findings usually means the target CIDR is unreachable from the scanner, or the relevant feature flag is off.
- Kubernetes scanning depends on its ClusterRoleBinding and ServiceAccount permissions.
- The BYOK key must be exactly 64 hex characters (32 bytes); anything else is rejected.
Deploying it
A deployment call covers the Helm or Docker install for your environment, CIDR scoping, BYOK key handling and rotation, and the air-gapped bundle if you need one. Talk to us about deployment